CVE-2023-52638

What it actually does

Causes a deadlock in the Linux kernel J1939 CAN implementation due to circular lock dependencies involving j1939_socks_lock (changed to rwlock), active_session_list_lock, and sk_session_queue_lock during socket and session operations.

Why it matters to the business

May result in system hangs or unresponsiveness on Linux hosts using J1939 networking, affecting availability in specialized environments such as automotive or industrial systems; low immediate risk given the local nature and absence from known exploitation lists.

How an attack unfolds

A local attacker triggers concurrent J1939 socket and session operations that acquire locks in conflicting orders, causing two threads to block indefinitely while waiting for each other; the change to rwlock breaks the cycle but does not address the underlying reference count issue.

How to fix it

Upgrade the Linux kernel to a version containing commit 03358aba991668d3bb2c65b3c82aa32c36851170; apply the full set of follow-on patches addressing the reference counting problem once available.

How to confirm the fix worked

Verify the presence of commit 03358aba991668d3bb2c65b3c82aa32c36851170 in the running kernel source; attempt reproduction of the original Syzbot deadlock scenario under load to confirm resolution.

Typical attack path

1. Obtain local code execution on an affected Linux system
2. Perform J1939 socket creation and session queue operations
3. Trigger netdevice unregister or concurrent lock acquisitions
4. Induce deadlock between the three involved locks

How to detect it

Inspect kernel logs and dmesg output for reports of task hangs, lockdep warnings, or J1939-related deadlocks; correlate with processes performing CAN socket operations.

What your security team should do

• Prioritize kernel updates on systems exposing J1939 interfaces
• Disable J1939 protocol if not required for operations
• Monitor kernel logs for hung tasks or deadlock warnings involving j1939
• Test updated kernels in staging environments before broad deployment