CVE-2023-52922

What it actually does

Use-after-free in Linux kernel CAN BCM where bcm_op is freed in bcm_release before procfs removal, allowing bcm_proc_show to read freed slab memory.

Why it matters to the business

Risk of kernel crashes, memory corruption, or limited privilege escalation on systems using CAN BCM sockets; low public exploitability reduces immediate widespread impact despite kernel-level exposure.

How an attack unfolds

Attacker allocates bcm_op via sendmsg on CAN BCM socket, triggers RCU-based free in bcm_release, then reads the corresponding procfs entry to access freed memory before reclamation.

How to fix it

Apply kernel patches resolving the ordering between bcm_release and procfs cleanup; no specific fixed versions listed for kernel packages in provided data.

How to confirm the fix worked

Confirm updated kernel builds contain the fix for bcm_proc_show UAF; test by exercising CAN BCM socket open/close and procfs reads under KASAN or similar sanitizers.

Typical attack path

1. Open CAN BCM socket and send configuration messages to allocate bcm_op
2. Close socket to invoke bcm_release and schedule RCU free of bcm_op
3. Open and read the associated /proc/net/can-bcm entry to trigger bcm_proc_show on freed object

How to detect it

Review kernel logs for KASAN reports mentioning bcm_proc_show and slab-use-after-free; inspect audit logs for unusual CAN BCM socket and procfs activity around the time of crashes.

What your security team should do

• Prioritize kernel updates on systems exposing CAN BCM interfaces
• Monitor EPSS trend and threat actor activity for any increase in targeting
• Restrict unprivileged access to CAN sockets and procfs entries where feasible