CVE-2022-50482 Linux内核IOMMU/VT-d si_domain内存泄漏漏洞

// CVE-2022-50482 PoC - Trigger si_domain memory leak in iommu/vt-d // This PoC demonstrates the vulnerability by repeatedly failing // the init_dmars() function to cause si_domain memory leak #include <linux/module.h> #include <linux/kernel.h> #include <linux/init.h> MODULE_LICENSE("GPL"); MODULE_AUTHOR("Security Researcher"); MODULE_DESCRIPTION("PoC for CVE-2022-50482 - iommu/vt-d si_domain memory leak"); static int __init cve_2022_50482_init(void) { // The vulnerability exists in init_dmars() error path // When init_dmars() fails, si_domain is not cleaned up // causing memory leak // Triggering conditions: // 1. Intel VT-d hardware must be present // 2. IOMMU must be enabled in BIOS // 3. Force init_dmars() to fail during boot // Example: Force failure by corrupting DMAR table // or by setting invalid IOMMU parameters printk(KERN_INFO "CVE-2022-50482: Attempting to trigger si_domain leak\n"); // The actual trigger requires kernel-level access to: // - intel-iommu.c init_dmars() function // - Force early return/error in the function // - Observe memory leak via /proc/meminfo or slabinfo // To verify the vulnerability: // 1. Boot kernel with intel_iommu=on // 2. Inject error condition in init_dmars() // 3. Check cat /proc/slabinfo | grep iommu_domain // 4. Observe leaked si_domain memory return 0; } static void __exit cve_2022_50482_exit(void) { printk(KERN_INFO "CVE-2022-50482: Module unloaded\n"); } module_init(cve_2022_50482_init); module_exit(cve_2022_50482_exit);