cve/2023/CVE-2023-5563.md

### [CVE-2023-5563](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5563)
![](https://img.shields.io/static/v1?label=Product&message=Zephyr&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=3.3%3C%3D%203.4%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=%20CWE-703%20Improper%20Check%20or%20Handling%20of%20Exceptional%20Conditions%20The%20product%20does%20not%20properly%20anticipate%20or%20handle%20exceptional%20conditions%20that%20rarely%20occur%20during%20normal%20operation%20of%20the%20product.&color=brighgreen)

### Description

The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal exception.

### POC

#### Reference
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-98mc-rj7w-7rpv

#### Github
No PoCs found on GitHub currently.