CVE-2022-50474：Linux内核macio设备内存泄漏漏洞

// CVE-2022-50474 PoC - Linux Kernel macio Memory Leak // This PoC demonstrates the memory leak by repeatedly triggering // macio device registration failure condition #include <linux/module.h> #include <linux/init.h> #include <linux/of.h> #include <linux/platform_device.h> #include <linux/slab.h> // Simulate the vulnerable code path in macio_add_one_device() // When of_device_register() fails, device_initialize() reference is leaked static int __init macio_leak_init(void) { struct platform_device *pdev; int i; int ret; pr_info("CVE-2022-50474 PoC: Triggering macio memory leak\n"); // Repeatedly attempt device registration to trigger memory leak for (i = 0; i < 1000; i++) { // Allocate a platform device (similar to macio device) pdev = kzalloc(sizeof(struct platform_device), GFP_KERNEL); if (!pdev) break; // device_initialize() acquires a reference device_initialize(&pdev->dev); // Simulate of_device_register() failure // In vulnerable version, put_device() is NOT called here // This causes the reference to leak ret = -1; // Force failure if (ret) { // VULNERABILITY: Missing put_device() call // In fixed version, put_device(&pdev->dev) should be called here // Without it, the device structure leaks memory continue; } } pr_info("CVE-2022-50474 PoC: Memory leak triggered %d times\n", i); return 0; } static void __exit macio_leak_exit(void) { pr_info("CVE-2022-50474 PoC: Module unloaded\n"); } module_init(macio_leak_init); module_exit(macio_leak_exit); MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("CVE-2022-50474 macio memory leak PoC"); // Fixed version should include: // if (ret) { // put_device(&pdev->dev); // Release the reference // return ret; // }