CVE-2022-50479 Linux内核drm/amd驱动内存泄漏漏洞

/* * CVE-2022-50479 PoC - Trigger memory leak in drm/amd driver * This PoC demonstrates how to trigger the clk_src memory leak * by repeatedly causing the error path to execute. * * Note: Requires AMD GPU hardware and appropriate kernel module loaded. * The vulnerability is in the error handling path where free() is used * instead of kfree() for clk_src, causing memory to not be released. */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <string.h> #include <errno.h> // Simulate the vulnerable code path // In real kernel code, this would be in drm/amd/display struct clk_src { int id; char name[64]; unsigned long frequency; void *private_data; }; // Vulnerable function - mimics the kernel bug // Uses free() instead of kfree() in kernel context struct clk_src* allocate_clk_src(int id) { struct clk_src *clk = (struct clk_src *)malloc(sizeof(struct clk_src)); if (!clk) { return NULL; } clk->id = id; snprintf(clk->name, sizeof(clk->name), "clk_src_%d", id); clk->frequency = 0; clk->private_data = NULL; // Simulate error condition check // In kernel: if (some_condition_failed) { // free(clk); // BUG: should be kfree(clk) in kernel // return NULL; // } return clk; } int main(int argc, char *argv[]) { int iterations = 1000; if (argc > 1) { iterations = atoi(argv[1]); } printf("CVE-2022-50479 PoC: Triggering clk_src memory leak\n"); printf("Iterations: %d\n", iterations); // Repeatedly trigger the error path to leak memory for (int i = 0; i < iterations; i++) { // In kernel context, this would trigger the vulnerable path // through AMD GPU driver ioctl or sysfs interface struct clk_src *clk = allocate_clk_src(i); if (clk) { // Normal path - memory is properly handled // In vulnerable kernel code, the error path leaks memory free(clk); // This simulates what SHOULD happen (kfree in kernel) } } printf("PoC execution completed. Check kernel memory usage.\n"); return 0; }