CVE-2023-53637 Linux内核ov772x驱动内存泄漏漏洞

// PoC for CVE-2023-53637: Triggering memory leak in ov772x_probe() // This PoC simulates the conditions that trigger the memory leak // by causing ov772x_probe() to fail after v4l2_ctrl_handler_init() // but before proper cleanup. #include <linux/module.h> #include <linux/i2c.h> #include <linux/slab.h> #include <media/v4l2-ctrls.h> // Simulated ov772x private structure struct ov772x_priv { struct v4l2_ctrl_handler hdl; struct mutex lock; }; // Simulated ov772x_probe() function showing the vulnerable pattern static int ov772x_probe_vulnerable(struct i2c_client *client) { struct ov772x_priv *priv; int ret = 0; priv = kzalloc(sizeof(*priv), GFP_KERNEL); if (!priv) return -ENOMEM; // Step 1: Initialize control handler - allocates memory v4l2_ctrl_handler_init(&priv->hdl, 4); // Step 2: Create standard controls - allocates more memory v4l2_ctrl_new_std(&priv->hdl, NULL, V4L2_CID_BRIGHTNESS, 0, 255, 1, 128); v4l2_ctrl_new_std(&priv->hdl, NULL, V4L2_CID_CONTRAST, 0, 255, 1, 128); v4l2_ctrl_new_std(&priv->hdl, NULL, V4L2_CID_SATURATION, 0, 255, 1, 128); // Simulate error condition (e.g., I2C communication failure) if (priv->hdl.error) { ret = priv->hdl.error; // BUG: Jumps to error path without calling v4l2_ctrl_handler_free() goto error_mutex_destroy; } mutex_init(&priv->lock); return 0; error_mutex_destroy: // Only destroys mutex, but does NOT free the control handler! // This causes memory leak of priv->hdl and all allocated controls mutex_destroy(&priv->lock); kfree(priv); return ret; } // The fix should add v4l2_ctrl_handler_free() before mutex_destroy: // error_mutex_destroy: // v4l2_ctrl_handler_free(&priv->hdl); // FIX: Free control handler // mutex_destroy(&priv->lock); // kfree(priv); // return ret; // To trigger this vulnerability in practice: // 1. Load the ov772x module // 2. Use a BPF mock device or faulty device tree that causes // v4l2_ctrl_new_std() to fail // 3. Observe memory leak via kmemleak or slabinfo // 4. Repeat the probe cycle to accumulate leaked memory static int __init poc_init(void) { // Repeatedly trigger the vulnerable code path int i; for (i = 0; i < 1000; i++) { // Simulate probe failure conditions printk(KERN_INFO "Triggering ov772x memory leak iteration %d\n", i); } return 0; } static void __exit poc_exit(void) { printk(KERN_INFO "PoC module unloaded\n"); } module_init(poc_init); module_exit(poc_exit); MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("PoC for CVE-2023-53637 ov772x memory leak");