CVE-2023-52638: Vulnerability in linux-libc-dev package - Deadlock in j1939 codebase
Summary
CVE-2023-52638: In the Linux kernel, the following vulnerability has been resolved: can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock The following 3 locks would race against each other, causing the deadlock situation... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary C library headers and symbolic links for the Linux kernel. It is used to compile and build applications that interact with the kernel. The package is an essential component for developers working on Linux-based systems. However, a vulnerability has been identified in the package that can lead to a deadlock situation in the j1939 codebase.
Vulnerability Detail
The vulnerability in the linux-libc-dev package arises from a race condition between three locks: j1939_socks_lock, active_session_list_lock, and sk_session_queue_lock. This race condition can cause a deadlock, resulting in a system freeze or unresponsiveness. The j1939_socks_lock is currently a regular lock, but changing it to a read-write lock (rwlock) can prevent the circular lock dependency and avoid the deadlock. It is important to note that this fix addresses the deadlock situation but does not resolve the underlying unregister_netdevice bug reported by Syzbot.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to apply the recommended fix by updating the linux-libc-dev package to the latest version.
Conclusion
The linux-libc-dev package is vulnerable to a deadlock situation in the j1939 codebase. To mitigate this vulnerability, it is crucial to update the package to version 6.1.90-1 or later. This update includes the necessary changes to prevent the deadlock. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package provides C library headers and symbolic links for the Linux kernel. It is essential for compiling and building applications that interact with the kernel.
A deadlock is a situation where two or more processes are unable to proceed because each is waiting for the other to release a resource.
The j1939 codebase is a component in the Linux kernel that implements the J1939 protocol, which is used for communication between automotive electronic control units.
The vulnerability can lead to a deadlock situation, causing the system to freeze or become unresponsive. This can impact the overall stability and availability of the system.
No known exploits for this vulnerability have been reported at the moment.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
