CVE-2023-54102

What it actually does

Insufficient bounds check on copy_from_user() into a fixed-size mybuf array in lpfc_debugfs_lockstat_write() allows writing more data than the buffer can hold, enabling local buffer overflow.

Why it matters to the business

Systems running the lpfc SCSI driver with debugfs enabled face risk of local kernel memory corruption that could lead to crashes or privilege escalation; the large number of downstream Linux and Wazuh deployments increases exposure surface even though exploitation remains uncommon.

How an attack unfolds

A local user with write access to the lpfc debugfs lockstat file supplies a payload larger than the target buffer; without the min() size restriction the kernel copies excess bytes, corrupting adjacent memory structures.

How to fix it

Upgrade the Linux kernel to commit 644a9d5e22761a41d5005a26996a643da96de962 or later; for Wazuh deployments upgrade to version 4.9.1+incompatible or newer that incorporates the fix.

How to confirm the fix worked

Confirm the running kernel contains commit 644a9d5e22761a41d5005a26996a643da96de962; verify Wazuh version is at least 4.9.1+incompatible; attempt to write a buffer exceeding the original mybuf size through the debugfs entry and confirm the operation is now truncated.

Typical attack path

1. Identify host with lpfc driver and debugfs mounted
2. Locate the lpfc lockstat debugfs entry
3. Write oversized data via copy_from_user path
4. Trigger buffer overflow to corrupt kernel memory
5. Escalate privileges or cause denial of service

How to detect it

Review kernel audit logs and debugfs access records for unusual write sizes to lpfc lockstat entries; examine crash dumps for signs of corruption near the lpfc debugfs buffer after the fix date.

What your security team should do

• Apply the referenced kernel and Wazuh updates within standard change windows given the low EPSS and absence from KEV
• Disable lpfc debugfs entries if not required for operations
• Monitor for future Linux kernel updates that backport the same bounds check