CVE-2023-52887

In the Linux kernel, the following vulnerability has been resolved:

net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new

This patch enhances error handling in scenarios with RTS (Request to Send) messages arriving closely. It replaces the less informative WARN_ON_ONCE backtraces with a new error handling method. This provides clearer error messages and allows for the early termination of problematic sessions. Previously, sessions were only released at the end of j1939_xtp_rx_rts().

Potentially this could be reproduced with something like: testj1939 -r vcan0:0x80 & while true; do # send first RTS cansend vcan0 18EC8090#1014000303002301; # send second RTS cansend vcan0 18EC8090#1014000303002301; # send abort cansend vcan0 18EC8090#ff00000000002301; done

A flaw of low impact was found in the Linux kernel's SAE J1939 CAN (Controller Area Network) transport protocol implementation in net/can/j1939/transport.c. When Request to Send (RTS) messages for a new transport session arrive in quick succession, inadequate error handling in xtp_rx_rts_session_new() left the problematic session in place until the end of j1939_xtp_rx_rts() and only produced WARN_ON_ONCE backtraces, which can affect availability on systems using the J1939 protocol. Red Hat rated this flaw Low severity (CVSS 3.3, local vector, availability-only impact) because triggering it requires the ability to send crafted J1939 frames on a system with a configured CAN interface. In Red Hat Enterprise Linux 9, the kernel and kernel-rt packages are affected, with the fix deferred given the low severity and the specialized J1939 configuration required to reach this code; the residual risk is limited local availability impact on systems actively using the J1939 protocol. Red Hat Enterprise Linux 6, 7, and 8, as well as Red Hat's Hosted OpenShift Clusters (ARO and OSD), are not affected. In Fedora, the community kernel package is affected and is fixed through the standard Fedora kernel update. The upstream CVE record assigns a higher severity (7.5, Important, network attack vector); Red Hat's assessment differs because this issue requires a locally configured CAN/J1939 interface and its impact is limited to availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Only systems with a configured CAN interface actively using the SAE J1939 protocol are exposed to this issue. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.