CVE-2022-50542 Linux内核si470x驱动释放后使用漏洞

/* * CVE-2022-50542 PoC - Trigger Use-After-Free in si470x driver * This PoC demonstrates the race condition between URB callback * and device object free in si470x_usb_driver_probe(). * * Note: Requires a malicious or specially crafted USB device * to trigger the vulnerable code path. */ #include <linux/module.h> #include <linux/usb.h> #include <linux/slab.h> #include <linux/delay.h> // Simulate the vulnerable si470x device structure struct si470x_device { struct usb_device *usbdev; struct urb *int_in_urb; unsigned char *int_in_buffer; // ... other fields }; // Vulnerable callback function static void si470x_int_in_callback(struct urb *urb) { struct si470x_device *radio = urb->context; // UAF: radio may have been freed already if (radio) { // Accessing freed memory here triggers UAF dev_info(&radio->usbdev->dev, "URB callback triggered\n"); } } // Simulate the vulnerable probe function static int si470x_usb_driver_probe(struct usb_interface *intf, const struct usb_device_id *id) { struct si470x_device *radio; int retval; radio = kzalloc(sizeof(*radio), GFP_KERNEL); if (!radio) return -ENOMEM; radio->usbdev = interface_to_usbdev(intf); radio->int_in_urb = usb_alloc_urb(0, GFP_KERNEL); radio->int_in_buffer = kzalloc(8, GFP_KERNEL); // Fill URB usb_fill_int_urb(radio->int_in_urb, radio->usbdev, usb_rcvintpipe(radio->usbdev, 1), radio->int_in_buffer, 8, si470x_int_in_callback, radio, 1); // Submit URB - succeeds retval = usb_submit_urb(radio->int_in_urb, GFP_KERNEL); if (retval) { kfree(radio); return retval; } // Simulate si470x_start() failure retval = -EIO; // Force failure if (retval < 0) { // BUG: URB is submitted but not killed before free kfree(radio); // UAF occurs when callback fires } return retval; } static void __exit poc_exit(void) { printk(KERN_INFO "PoC module unloaded\n"); } module_exit(poc_exit); MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("CVE-2022-50542 PoC");