CVE-2023-5563: The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This…

PriorityP335high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

0.45%

35.8th percentile

The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal exception.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
zephyrproject-rtos	zephyr	3.3 – 3.4	—
zephyrproject	zephyr	<= 3.4.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.