CVE-2026-23257 Linux内核liquidio驱动setup_nic_devices()内存泄漏漏洞

// CVE-2026-23257 PoC - Memory Leak in liquidio setup_nic_devices() // This PoC demonstrates the off-by-one error in cleanup loop // Compile and run on affected Linux kernel with liquidio driver #include <stdio.h> #include <stdlib.h> #include <string.h> // Simulated structure for demonstration struct nic_device { void* devlink; void* netdev; int allocated; }; // Vulnerable cleanup function (original buggy version) void buggy_cleanup(struct nic_device* devices, int i) { printf("[BUGGY] Starting cleanup with i=%d\n", i); // Original buggy loop - skips index i while (i--) { printf("[BUGGY] Freeing device at index %d\n", i); if (devices[i].devlink) { free(devices[i].devlink); devices[i].devlink = NULL; } if (devices[i].netdev) { free(devices[i].netdev); devices[i].netdev = NULL; } devices[i].allocated = 0; } printf("[BUGGY] Cleanup complete. Device at index %d leaked!\n", i); } // Fixed cleanup function void fixed_cleanup(struct nic_device* devices, int i) { printf("[FIXED] Starting cleanup with i=%d\n", i); // Fixed loop - iterate from current index down to 0 while (i >= 0) { printf("[FIXED] Freeing device at index %d\n", i); if (devices[i].devlink) { free(devices[i].devlink); devices[i].devlink = NULL; } if (devices[i].netdev) { free(devices[i].netdev); devices[i].netdev = NULL; } devices[i].allocated = 0; i--; } printf("[FIXED] Cleanup complete. No memory leaked.\n"); } int main() { printf("=== CVE-2026-23257 PoC Demonstration ===\n\n"); // Simulate 5 devices being allocated struct nic_device devices[5]; int alloc_count = 5; for (int j = 0; j < alloc_count; j++) { devices[j].devlink = malloc(1024); devices[j].netdev = malloc(2048); devices[j].allocated = 1; printf("Allocated device %d\n", j); } printf("\n--- Testing Buggy Cleanup (failure at index 3) ---\n"); int fail_index = 3; buggy_cleanup(devices, fail_index); printf("\n--- Testing Fixed Cleanup (failure at index 3) ---\n"); // Re-allocate for fixed test for (int j = 0; j < alloc_count; j++) { devices[j].devlink = malloc(1024); devices[j].netdev = malloc(2048); } fixed_cleanup(devices, fail_index); printf("\n=== PoC Complete ===\n"); printf("The buggy version leaks device at index %d\n", fail_index); printf("The fixed version properly frees all resources.\n"); return 0; }