CVE-2023-52869

What it actually does

Missing validation of kstrdup() return value in pstore/platform.c allows a NULL pointer to be dereferenced when memory allocation fails, resulting in a kernel panic.

Why it matters to the business

Local users on affected Linux kernels can trigger system crashes that disrupt operations and require reboots, with higher risk on memory-constrained or high-load systems; the large number of downstream Linux distributions increases exposure.

How an attack unfolds

An attacker with local access creates memory pressure and invokes pstore logging paths so that kstrdup() fails, the unchecked NULL is dereferenced, and the kernel panics.

How to fix it

Upgrade the Linux kernel to a version containing commit bb166bdae1a7d7db30e9be7e6ccaba606debc05f or later; apply the patch that adds the kstrdup() return-value check before the pointer is used.

How to confirm the fix worked

Confirm the running kernel includes commit bb166bdae1a7d7db30e9be7e6ccaba606debc05f by inspecting the source or changelog, then attempt to reproduce the allocation-failure scenario under controlled conditions to verify the panic no longer occurs.

Typical attack path

1. Obtain local user or process access on a vulnerable Linux system
2. Induce memory exhaustion to force kstrdup() failure
3. Trigger pstore platform code paths that call kstrdup() without checking the result
4. Cause NULL pointer dereference leading to kernel panic

How to detect it

Review kernel logs and crash dumps for oops or panic messages originating from pstore/platform.c around the time of unexpected reboots; correlate with low-memory events.

What your security team should do

• Apply the kernel patch containing bb166bdae1a7d7db30e9be7e6ccaba606debc05f to all affected systems as soon as possible
• Prioritize patching on systems that use pstore or run under memory pressure
• Monitor for kernel oops reports referencing pstore/platform after deployment