CVE-2023-54152

Vulnerability

Overview

CVE-2023-54152 is a deadlock vulnerability in the Linux kernel's CAN (Controller Area Network) J1939 protocol implementation. The root cause is a circular lock dependency that can be triggered when a J1939 session is active (e.g., during data TP/ETP transfer) and a user-space application subscribes to the error queue while a network interface down event occurs. The deadlock involves three locks: active_session_list_lock, sk_session_queue_lock, and j1939_socks_lock, which can be acquired in conflicting orders on different CPUs [1].

Exploitation

Conditions

An attacker would need to be able to trigger a net down event on a CAN interface while a J1939 data transfer session is in progress and a process(es) have subscribed to the error queue. This scenario can occur locally on a system using the J1939 protocol stack. No special privileges beyond the ability to send CAN frames and manage network interfaces are required, but the attack surface is limited to systems with the J1939 module loaded and active sessions [1].

Impact

Impact

If the deadlock is triggered, the kernel enters a state where affected processes hang indefinitely, leading to a denial of service (DoS) on the system. The deadlock can cause a system hang or panic, making the machine unavailable. There is no evidence of memory corruption or privilege escalation from this bug [1].

Mitigation

The fix, committed in kernel stable tree commit f09ce9d765de, moves the j1939_sk_errqueue() call outside the active_session_list_lock context, breaking the circular lock chain. Users should apply the latest stable kernel updates that include this patch. No workaround is available other than avoiding the specific combination of operations (e.g., not subscribing to error queue subscription during active sessions) [1].