CVE-2023-54152
In the Linux kernel, the following vulnerability has been resolved: can: j1939: prevent deadlock by moving j1939_sk_errqueue() This commit addresses a deadlock situation that can occur in certain scenarios, such as when running data TP/ETP transfer and subscribing to the error queue while receiving a net down event. The deadlock involves locks in the following order: 3 j1939_session_list_lock -> active_session_list_lock j1939_session_activate ... j1939_sk_queue_activate_next -> sk_session_queue_lock ... j1939_xtp_rx_eoma_one 2 j1939_sk_queue_drop_all -> sk_session_queue_lock ... j1939_sk_netdev_event_netdown -> j1939_socks_lock j1939_netdev_notify 1 j1939_sk_errqueue -> j1939_socks_lock __j1939_session_cancel -> active_session_list_lock j1939_tp_rxtimer CPU0 CPU1 ---- ---- lock(&priv->active_session_list_lock); lock(&jsk->sk_session_queue_lock); lock(&priv->active_session_list_lock); lock(&priv->j1939_socks_lock); The solution implemented in this commit is to move the j1939_sk_errqueue() call out of the active_session_list_lock context, thus preventing the deadlock situation.
Affected versions
Linux kernel versions
5.15
and later are affected. Fixed in
5.15.106,
6.1.23,
6.2.10,
6.3
and their respective stable series.
References
The following references provide additional information about CVE-2023-54152 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/8a581b71cf686b4cd1a85c9c2dfc2fb88382c3b4
-
PatchKernel patch commithttps://git.kernel.org/stable/c/ace6aa2ab5ba5869563ca689bbd912100514ae7b
-
PatchKernel patch commithttps://git.kernel.org/stable/c/d1366b283d94ac4537a4b3a1e8668da4df7ce7e9
Frequently asked questions
-
What is CVE-2023-54152?
CVE-2023-54152 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.15 onward and has been patched in 5.15.106, 6.1.23, 6.2.10 and others. CVE-2023-54152 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2023-54152?
Yes — CVE-2023-54152 has been patched. Fixed versions include 5.15.106, 6.1.23, 6.2.10 and others. If you are running Linux kernel 5.15 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2023-54152 actively exploited?
No — CVE-2023-54152 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.