CVE-2023-5563 (published 2023-10-12T23:11:18.074Z)
The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOVERY=y. This results in calling k_sleep() in IRQ context, causing a fatal exception.
Affected products: Vendor: zephyrproject-rtos
Product: Zephyr
Versions: 3.3