CVE-2023-5563
📋 TL;DR
This vulnerability in the Zephyr RTOS SJA1000 CAN controller driver causes a fatal exception when attempting automatic bus-off recovery in interrupt context. It affects systems using Zephyr RTOS with the vulnerable driver configuration, potentially causing denial-of-service conditions in embedded devices.
💻 Affected Systems
- Zephyr RTOS
📦 What is this software?
Zephyr by Zephyrproject
⚠️ Risk & Real-World Impact
Worst Case
System crash or kernel panic leading to complete denial-of-service, requiring physical reset or power cycle of affected embedded devices.
Likely Case
System instability or crashes when CAN bus experiences bus-off conditions, disrupting device functionality.
If Mitigated
Minor performance impact from disabling auto-recovery feature, requiring manual intervention for bus recovery.
🎯 Exploit Status
Exploitation requires triggering a CAN bus-off condition, which could occur naturally during network faults or be induced by an attacker on the CAN bus.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Zephyr v3.5.0 and later
Vendor Advisory: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-98mc-rj7w-7rpv
Restart Required: Yes
Instructions:
1. Update Zephyr RTOS to version 3.5.0 or later. 2. Rebuild firmware with updated Zephyr source. 3. Flash updated firmware to affected devices. 4. Verify CONFIG_CAN_AUTO_BUS_OFF_RECOVERY is properly configured.
🔧 Temporary Workarounds
Disable auto bus-off recovery
allDisable the vulnerable configuration option during build to prevent the issue.
Set CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=n in project configuration
🧯 If You Can't Patch
- Disable CONFIG_CAN_AUTO_BUS_OFF_RECOVERY in build configuration
- Implement CAN bus monitoring to detect and prevent bus-off conditions
🔍 How to Verify
Check if Vulnerable:
Check if Zephyr version is ≤3.4.0 and CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y is enabled in build configuration.Check Version:
Check Zephyr version in source code or build outputVerify Fix Applied:
Verify Zephyr version is ≥3.5.0 or CONFIG_CAN_AUTO_BUS_OFF_RECOVERY is disabled.📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages
- Fatal exception logs
- CAN bus error recovery attempts
Network Indicators:
- CAN bus error frames
- Unusual CAN bus traffic patterns
SIEM Query:
Search for 'fatal exception', 'kernel panic', or 'CAN bus-off' in system logs