CVE-2023-54198

What it actually does

Out-of-bounds access in tty_driver_lookup_tty() allows returning a tty struct for an invalid index without validation, resulting in NULL pointer dereference during tty_open when an invalid console device is specified in boot parameters.

Why it matters to the business

Kernel crashes during boot on systems configured with unsupported console devices, causing denial of service, boot failures, and potential downtime for affected Linux deployments; low exploitation likelihood limits widespread operational risk.

How an attack unfolds

An attacker with control over kernel boot parameters supplies an invalid console device such as tty3270, triggering the unchecked lookup in tty_driver_lookup_tty during early kernel initialization and leading to a crash in tty_open.

How to fix it

Upgrade Linux kernel to a version containing commit 3df6f492f500a16c231f07ccc6f6ed1302caddf9 or later; for the Echo product apply the fixed version labeled 1.

How to confirm the fix worked

Verify kernel version includes the referenced commit; attempt reproduction with the provided QEMU boot line containing console=tty3270 and confirm absence of NULL pointer oops.

Typical attack path

1. Gain ability to modify kernel command line or boot configuration
2. Append invalid console= parameter such as console=tty3270
3. Trigger system boot or restart
4. Kernel executes console_on_rootfs which calls into tty_open and dereferences invalid pointer

How to detect it

Inspect kernel boot logs and dmesg for BUG: kernel NULL pointer dereference entries with RIP in tty_open; search for console_on_rootfs call traces indicating early initialization failure.

• BUG: kernel NULL pointer dereference, address: 00000000000000ef
• tty_open+0x268/0x6f0
• console_on_rootfs+0x14/0x4d
• console=tty3270

What your security team should do

• Prioritize patching production kernels within standard maintenance windows given low EPSS and no KEV listing
• Audit boot configurations to remove or validate console= parameters against supported tty devices
• Monitor kernel logs for oops messages referencing tty_open or tty_driver_lookup_tty