google / google/security-research
Incorrect Exploit Mapping in KernelCTF (CVE-2023-3609 & CVE-2023-3776)
- Dominant language
- C
- Stars
- 4.6k
- Forks
- 582
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 3
Description
# CVE-2023-3609
CVE-2023-3609's [PoC][1] does not exploit the described vulnerability; instead, it targets CVE-2023-4208.
Considering the vulnerability of CVE-2023-3609 described actually takes a very long time to trigger since it can only increase `refcnt`. I investigated and traced the PoC. I found it actually took advantage of the copied `res` structure in `u32_init_knode` (CVE-2023-4208): The exp script tries to bind the classifier to a non-existent class and it would trigger `refcnt--` on the copied pointer (leads to UAF). When I applied the patch of CVE-2023-4208 on the linux kernel version the POC worked, the POC no longer works.
# CVE-2023-3776
CVE-2023-3776's [PoC][2] has the same issue—it actually exploits CVE-2023-4207.
[1]: https://github.com/google/security-research/tree/master/pocs/linux/kernelctf/CVE-2023-3609_cos_mitigation
[2]: https://github.com/google/security-research/tree/master/pocs/linux/kernelctf/CVE-2023-3776_lts
Contributor guide
Assessment
This issue has not been assessed yet.