The locks held by a transaction last as long as the transaction lasts*. The only way to release them is to end the transaction.
What does "crashed" mean precisely? In a three-tier application, when the front-end fails, the middle tier generally cleans up by closing the logical session which closes any associated transactions. In a client-server application, if the holder of the lock doesn't shut down gracefully, Oracle may not be immediately aware. The DBA would normally configure dead-connection detection to periodically send a ping to the client to verify that they are still alive so that the database can identify that a dead session exists after a few minutes and roll it back. If the database isn't configured to detect the problem and the client/server application doesn't close the transaction, you may have a bit of a wait. There may be a profile that limits the time a session can be connected or a DBA script that kills sessions after a period of time or you might have to call up the DBA and ask them to kill the other session.
*
To be pedantic, there are user-defined locks that you can acquire via dbms_lock
that persist for the session rather than for the transaction. But that's outside the scope of this question.