CVE-2023-53664 Linux内核OPP子系统空指针解引用漏洞

// CVE-2023-53664 PoC - Trigger null pointer dereference in OPP subsystem // This PoC demonstrates how to trigger the vulnerability by calling // dev_pm_opp_get_required_pstate() with invalid conditions #include <linux/module.h> #include <linux/init.h> #include <linux/pm_opp.h> #include <linux/device.h> // Simulate the vulnerable code path // The original buggy code dereferences 'opp' before IS_ERR_OR_NULL() check static void trigger_vulnerable_path(struct device *dev) { struct dev_pm_opp *opp; unsigned int pstate; // This simulates the lookup that may return NULL or ERR_PTR opp = dev_pm_opp_find_freq_ceil(dev, 0); // BUG: 'opp' is dereferenced before the IS_ERR_OR_NULL() check // In the vulnerable version, something like this would happen: // pstate = opp->pstate; // NULL dereference if opp is NULL! // The fixed version should check first: if (IS_ERR_OR_NULL(opp)) { pr_err("OPP is invalid\n"); return; } pstate = dev_pm_opp_get_required_pstate(opp, 0); pr_info("Required pstate: %u\n", pstate); } static int __init poc_init(void) { pr_info("CVE-2023-53664 PoC module loaded\n"); // In a real scenario, this would be triggered by specific // device operations that invoke the OPP subsystem return 0; } static void __exit poc_exit(void) { pr_info("CVE-2023-53664 PoC module unloaded\n"); } module_init(poc_init); module_exit(poc_exit); MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("PoC for CVE-2023-53664");