CVE-2022-3633

What it actually does

The vulnerability causes a memory leak in the j1939_session_destroy function within the Linux kernel's J1939 CAN transport implementation due to improper handling of session resources.

Why it matters to the business

Affected systems may experience gradual memory depletion, leading to performance degradation or denial of service on Linux hosts using the J1939 protocol, with higher urgency for organizations running unpatched kernels in automotive or industrial environments.

How an attack unfolds

A local attacker repeatedly triggers J1939 session creation and destruction operations to invoke the flawed function without proper memory cleanup, exhausting kernel resources over time.

How to fix it

Apply the upstream patch to net/can/j1939/transport.c in the Linux kernel; upgrade to a fixed kernel version from the distribution vendor once available.

How to confirm the fix worked

Review kernel source for the memory leak fix in j1939_session_destroy, perform memory profiling under J1939 load, and confirm no leaks occur after applying updates.

Typical attack path

1. Obtain local user access on a Linux system
2. Interact with the J1939 CAN subsystem to establish sessions
3. Force repeated session destruction to trigger the leak
4. Monitor for memory exhaustion leading to system instability

How to detect it

Inspect kernel logs and memory statistics for patterns of increasing allocation tied to J1939 session handling; look for repeated session operations in audit logs on systems with CAN support.

What your security team should do

• Prioritize kernel updates on systems exposing J1939 interfaces
• Restrict local access and limit J1939 protocol usage to trusted processes
• Implement memory usage monitoring for early detection of leaks