CVE-2026-22991: Linux kernel libceph NULL指针解引用漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> /* PoC concept for CVE-2026-22991 NULL pointer dereference * This demonstrates the vulnerability in libceph's free_choose_arg_map() * * The vulnerability occurs when: * 1. arg_map->size is set to non-zero value * 2. arg_map->args allocation fails (returns NULL) * 3. free_choose_arg_map() is called with non-zero size but NULL args * 4. The function iterates over args and dereferences NULL pointer */ struct choose_arg_map { size_t size; void **args; // NULL when allocation fails }; void free_choose_arg_map_vulnerable(struct choose_arg_map *arg_map) { // Vulnerable: iterates without checking if args is NULL for (size_t i = 0; i < arg_map->size; i++) { free(arg_map->args[i]); // NULL pointer dereference here } free(arg_map->args); free(arg_map); } void free_choose_arg_map_fixed(struct choose_arg_map *arg_map) { // Fixed: check args before iterating if (arg_map->args != NULL) { for (size_t i = 0; i < arg_map->size; i++) { free(arg_map->args[i]); } free(arg_map->args); } free(arg_map); } int trigger_vulnerability(void) { struct choose_arg_map *arg_map = malloc(sizeof(struct choose_arg_map)); if (!arg_map) return -1; // Simulate partial allocation failure scenario arg_map->size = 10; // Set size before allocation arg_map->args = NULL; // Allocation would fail here in real scenario // This will trigger NULL pointer dereference free_choose_arg_map_vulnerable(arg_map); return 0; }