google / google/security-research

Incorrect Exploit Mapping in KernelCTF (CVE-2023-3609 & CVE-2023-3776)

Open
#163 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
4.6k
Forks
582
Avg merge
1d 5h
Merged PRs (30d)
3

Description

# CVE-2023-3609

CVE-2023-3609's [PoC][1] does not exploit the described vulnerability; instead, it targets CVE-2023-4208.

Considering the vulnerability of CVE-2023-3609 described actually takes a very long time to trigger since it can only increase `refcnt`. I investigated and traced the PoC. I found it actually took advantage of the copied `res` structure in `u32_init_knode` (CVE-2023-4208): The exp script tries to bind the classifier to a non-existent class and it would trigger `refcnt--` on the copied pointer (leads to UAF). When I applied the patch of CVE-2023-4208 on the linux kernel version the POC worked, the POC no longer works.

# CVE-2023-3776

CVE-2023-3776's [PoC][2] has the same issue—it actually exploits CVE-2023-4207.

[1]: https://github.com/google/security-research/tree/master/pocs/linux/kernelctf/CVE-2023-3609_cos_mitigation
[2]: https://github.com/google/security-research/tree/master/pocs/linux/kernelctf/CVE-2023-3776_lts

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.