CVE-2023-53641 Linux内核ath9k驱动内存泄漏漏洞

// CVE-2023-53641 PoC - Triggering remain_skb memory leak in ath9k hif_usb // This PoC demonstrates how to trigger the memory leak by manipulating // the ath9k USB device state to cause URBs to be deallocated while // remain_skb is still allocated. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/ioctl.h> #include <linux/usbdevice_fs.h> // Simulate the vulnerable code path // In the ath9k driver, remain_skb is allocated in ath9k_hif_usb_rx_stream() // when processing URBs that contain partial data spanning multiple URBs. struct hif_dev { void *remain_skb; // Cached SKB for multi-URB data int rx_urbs_allocated; }; // Vulnerable function: allocates remain_skb but may not free it // when URBs are deallocated void ath9k_hif_usb_rx_stream(struct hif_dev *dev) { if (dev->remain_skb == NULL) { // Allocate remain_skb for partial data dev->remain_skb = malloc(4096); printf("Allocated remain_skb: %p\n", dev->remain_skb); // Simulate memcpy of partial data memcpy(dev->remain_skb, "partial_data", 12); } else { // Process the cached remain_skb printf("Processing remain_skb: %p\n", dev->remain_skb); free(dev->remain_skb); dev->remain_skb = NULL; } } // Trigger: deallocate URBs without processing remain_skb void trigger_memory_leak(struct hif_dev *dev) { // Step 1: Receive first URB - allocates remain_skb ath9k_hif_usb_rx_stream(dev); // Step 2: Simulate device suspend/deinit - URBs are freed // but remain_skb is NOT freed (the bug) dev->rx_urbs_allocated = 0; printf("URBs deallocated, remain_skb leaked: %p\n", dev->remain_skb); // remain_skb is now leaked - it won't be freed // because ath9k_hif_usb_rx_stream() won't be called again } int main() { struct hif_dev dev = {0}; // Trigger the leak multiple times to accumulate leaked memory for (int i = 0; i < 1000; i++) { dev.remain_skb = NULL; // Reset for each iteration trigger_memory_leak(&dev); // In real scenario, the leaked memory accumulates } printf("Memory leak triggered successfully\n"); return 0; } // Fix: Add explicit free of remain_skb when URBs are deallocated // void ath9k_hif_usb_dealloc_urbs(struct hif_dev *dev) { // if (dev->remain_skb) { // kfree_skb(dev->remain_skb); // dev->remain_skb = NULL; // } // // ... deallocate URBs ... // }