CVE-2025-39960 Linux内核gpiolib未初始化结构体导致驱动故障漏洞

// CVE-2025-39960 PoC - Demonstrating uninitialized struct usage in gpiolib:acpi // This PoC shows the kernel code path that triggers the vulnerability // The vulnerable code path is in drivers/gpio/gpiolib-acpi.c // Before the fix, acpi_gpio_info was not initialized before being passed // to __acpi_find_gpio() #include <linux/init.h> #include <linux/acpi.h> // Simulate the vulnerable call pattern static int trigger_vuln_path(struct acpi_device *adev) { struct acpi_gpio_info info; // BUG: uninitialized struct! // Fix would be: memset(&info, 0, sizeof(info)); // This call uses info.quirks which contains garbage struct gpio_desc *desc = __acpi_find_gpio(adev, NULL, 0, &info); if (IS_ERR(desc)) { // Returns -22 (EINVAL) due to uninitialized quirks pr_err("GPIO lookup failed: %ld\n", PTR_ERR(desc)); return PTR_ERR(desc); } return 0; } // Trigger via i2c_hid_acpi driver probe // On affected systems, loading i2c_hid_acpi will show: // [ 58.122916] i2c_hid_acpi i2c-UNIW0001:00: HID over i2c has not been provided an Int IRQ // [ 58.123097] i2c_hid_acpi i2c-UNIW0001:00: probe with driver i2c_hid_acpi failed with error -22 // To reproduce: // 1. Boot a kernel with the vulnerable commit (7c010d463372) but without the fix // 2. Ensure an I2C HID device is present (e.g., touchscreen) // 3. Observe the probe failure in dmesg