CVE-2023-53634：Linux内核arm64 BPF trampoline BTI异常漏洞

// PoC for CVE-2023-53634 // This PoC demonstrates how to trigger the BTI exception in Linux kernel BPF trampoline // on arm64 architecture when BPF_TRAMP_F_CALL_ORIG is used with a function whose // call site is not followed by PACIASP or BTI instruction. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/syscall.h> #include <linux/bpf.h> // Simplified BPF program to trigger the vulnerability // In real scenario, use libbpf to load a tracing/fentry BPF program // attached to a function whose call site is not followed by PACIASP int main() { // The vulnerability is triggered when: // 1. BPF_TRAMP_F_CALL_ORIG is set in trampoline // 2. The target function's call site is followed by ADD instruction // instead of PACIASP or BTI // // Example trigger: load a BPF fentry program on bpf_fentry_test1 // which has the following instruction sequence: // bpf_fentry_test1: // bti c // nop // nop // add w0, w0, #0x1 <-- not PACIASP, triggers BTI exception // paciasp // // When BPF trampoline uses BLR to jump to the ADD instruction, // BTI branch target check fails, causing kernel panic. printf("CVE-2023-53634 PoC\n"); printf("Load BPF fentry program on bpf_fentry_test1 to trigger BTI exception\n"); printf("Requires arm64 hardware with BTI enabled\n"); printf("Run: ./test_progs -t fentry\n"); // Use bpf() syscall to load and attach BPF program // The actual implementation requires libbpf and proper BPF program loading return 0; }