Incorrect Exploit Mapping in KernelCTF (CVE-2023-3609 & CVE-2023-3776)

[n132]

CVE-2023-3609

CVE-2023-3609's PoC does not exploit the described vulnerability; instead, it targets CVE-2023-4208.

Considering the vulnerability of CVE-2023-3609 described actually takes a very long time to trigger since it can only increase refcnt. I investigated and traced the PoC. I found it actually took advantage of the copied res structure in u32_init_knode (CVE-2023-4208): The exp script tries to bind the classifier to a non-existent class and it would trigger refcnt-- on the copied pointer (leads to UAF). When I applied the patch of CVE-2023-4208 on the linux kernel version the POC worked, the POC no longer works.

CVE-2023-3776

CVE-2023-3776's PoC has the same issue—it actually exploits CVE-2023-4207.