CVE-2023-54152

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

can: j1939: prevent deadlock by moving j1939_sk_errqueue()

This commit addresses a deadlock situation that can occur in certain

scenarios, such as when running data TP/ETP transfer and subscribing to

the error queue while receiving a net down event. The deadlock involves

locks in the following order:

3

j1939_session_list_lock -> active_session_list_lock

j1939_session_activate

...

j1939_sk_queue_activate_next -> sk_session_queue_lock

...

j1939_xtp_rx_eoma_one

2

j1939_sk_queue_drop_all -> sk_session_queue_lock

...

j1939_sk_netdev_event_netdown -> j1939_socks_lock

j1939_netdev_notify

1

j1939_sk_errqueue -> j1939_socks_lock

__j1939_session_cancel -> active_session_list_lock

j1939_tp_rxtimer

CPU0 CPU1

---- ----

lock(&priv->active_session_list_lock);

lock(&jsk->sk_session_queue_lock);

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References