Vulnerability in Kernel (CVE-2023-54045)

Summary

Vulnerability in Kernel (CVE-2023-54045). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 4.14.326, 4.19.295, 5.4.257, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3 or later.

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

audit: fix possible soft lockup in __audit_inode_child()

Tracefs or debugfs maybe cause hundreds to thousands of PATH records,
too many PATH records maybe cause soft lockup.

For example:

CONFIG_KASAN=y && CONFIG_PREEMPTION=n
auditctl -a exit,always -S open -k key
sysctl -w kernel.watchdog_thresh=5
mkdir /sys/kernel/debug/tracing/instances/test

There may be a soft lockup as follows:
watchdog: BUG: soft lockup - CPU#45 stuck for 7s! [mkdir:15498]
Kernel panic - not syncing: softlockup: hung tasks
Call trace:
dump_backtrace+0x0/0x30c
show_stack+0x20/0x30
dump_stack+0x11c/0x174
panic+0x27c/0x494
watchdog_timer_fn+0x2bc/0x390
__run_hrtimer+0x148/0x4fc
__hrtimer_run_queues+0x154/0x210
hrtimer_interrupt+0x2c4/0x760
arch_timer_handler_phys+0x48/0x60
handle_percpu_devid_irq+0xe0/0x340
__handle_domain_irq+0xbc/0x130
gic_handle_irq+0x78/0x460
el1_irq+0xb8/0x140
__audit_inode_child+0x240/0x7bc
tracefs_create_file+0x1b8/0x2a0
trace_create_file+0x18/0x50
event_create_dir+0x204/0x30c
__trace_add_new_event+0xac/0x100
event_trace_add_tracer+0xa0/0x130
trace_array_create_dir+0x60/0x140
trace_array_create+0x1e0/0x370
instance_mkdir+0x90/0xd0
tracefs_syscall_mkdir+0x68/0xa0
vfs_mkdir+0x21c/0x34c
do_mkdirat+0x1b4/0x1d4
__arm64_sys_mkdirat+0x4c/0x60
el0_svc_common.constprop.0+0xa8/0x240
do_el0_svc+0x8c/0xc0
el0_svc+…

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2023-54045 has been found in Kernel.
Risk of unauthorized operations or information disclosure.
What to do: upgrade Kernel to 4.14.326, 4.19.295, 5.4.257, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3 or later.
If unsure, ask your IT team or search "Kernel CVE-2023-54045" on the vendor's site.

CVE-2023-54045 (Kernel)
Patched: 4.14.326, 4.19.295, 5.4.257, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (unclassified) exists in Kernel.

📍 Affected scope

Check the vendor advisory for the affected versions of Kernel.

🔥 Severity

Severity: ?. Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 4.14.326, 4.19.295, 5.4.257, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'Kernel' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'Kernel' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で Kernel を grep し、稼働しているサービス・バージョンを把握する。
2
Apply patch patch
```
Upgrade Kernel to 4.14.326, 4.19.295, 5.4.257, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3
```
ステージング環境で 4.14.326, 4.19.295, 5.4.257, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
3
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"4.14.326"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.15.0"},{"fixed":"4.19.295"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.20.0"},{"fixed":"5.4.257"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.10.195"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.132"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.53"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.4.16"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.5.0"},{"fixed":"6.5.3"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2023-54045 linux Fixed in: 5.10.197-1
Ubuntu UBUNTU-CVE-2023-54045 linux