CVE-2023-54189

What it actually does

Unchecked kstrdup() return value in pstore/ram allows NULL pointer dereference on allocation failure.

Why it matters to the business

Kernel instability or crashes on systems using pstore/ram under memory pressure, with low exploitation likelihood per EPSS 0.00205 and no KEV listing.

How an attack unfolds

An attacker with local access induces memory pressure to force kstrdup failure during pstore/ram initialization, triggering the NULL dereference; no named threat actors or ransomware usage reported.

How to fix it

Upgrade Linux kernel to version 5.4.251 or apply commit 8430a8e8e85420d4cb51dcb08b0278ab194ea82f; verify fixed version in affected distributions such as Echo linux package version 1.

How to confirm the fix worked

Confirm kernel version is at or above the listed fixed releases; review pstore/ram source for kstrdup return-value check presence.

Typical attack path

1. Gain local access to target system
2. Trigger pstore/ram code path under constrained memory
3. Force kstrdup allocation failure
4. Trigger NULL pointer dereference in kernel

How to detect it

Review kernel logs for pstore/ram NULL dereference oops around allocation sites; no specific post-exploitation artifacts derivable from public details.

What your security team should do

• Prioritize patching production kernels within standard change windows given low EPSS and absence from KEV
• Monitor for upstream stable updates in linux.git and distribution backports
• Test pstore functionality post-upgrade under memory-constrained conditions