CVE-2023-54178

What it actually does

Null pointer dereference in Linux kernel of_unittest_find_node_by_name() when kasprintf() fails to allocate memory for name or full_name, causing strcmp() to receive NULL.

Why it matters to the business

May trigger kernel crashes or instability during device tree unit testing under low-memory conditions; low overall risk given limited code path and no known exploitation.

How an attack unfolds

An attacker would need to trigger the device-tree unittest code path while simultaneously inducing a memory allocation failure in kasprintf(); no named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Upgrade affected Linux packages to the fixed versions: Debian 12/13/14 to 6.1.4-1 or later; mainline stable trees to commit c364fa869b33ca42a263bf91c22fce7e6c61d479 or newer.

How to confirm the fix worked

Verify running kernel version is at or above the listed fixed releases; inspect kernel source for presence of the null-check before strcmp in of_unittest_find_node_by_name().

Typical attack path

1. Gain ability to execute or influence device-tree unittest code
2. Apply memory pressure to force kasprintf() failure
3. Invoke strcmp() on resulting NULL pointer to trigger kernel oops or panic

How to detect it

Search kernel logs for oops or panic messages referencing of_unittest_find_node_by_name or kasprintf failures during device-tree operations; no public exploitation artifacts exist.

What your security team should do

• Apply the listed kernel updates on all affected systems as part of routine patching
• Monitor for any device-tree unittest activity in development or test environments
• Review memory-allocation error paths in similar kernel code for analogous issues