CVE-2025-71087 Linux内核iavf驱动RSS配置Off-by-One漏洞

// CVE-2025-71087 PoC - Trigger off-by-one in iavf_config_rss_reg // This demonstrates the boundary condition that causes the vulnerability #include <stdio.h> #include <stdint.h> // Simulate the vulnerable condition void demonstrate_offbyone_vulnerability(void) { uint32_t rss_key_size = 52; // Typical RSS key size uint32_t rss_lut_size = 128; // Typical LUT size uint32_t num_dwords_key = rss_key_size / 4; // = 13 uint32_t num_dwords_lut = rss_lut_size / 4; // = 32 printf("RSS Key: %d dwords, valid indices: 0 to %d\n", num_dwords_key, num_dwords_key - 1); printf("RSS LUT: %d dwords, valid indices: 0 to %d\n", num_dwords_lut, num_dwords_lut - 1); // Vulnerable code pattern (using <=) printf("\n[VULNERABLE] Loop with <= condition:\n"); for (uint32_t i = 0; i <= num_dwords_key / 4; i++) { printf(" Accessing index %u (last valid: %u)\n", i, num_dwords_key - 1); if (i > num_dwords_key - 1) { printf(" *** OUT-OF-BOUNDS ACCESS at index %u! ***\n", i); } } // Fixed code pattern (using <) printf("\n[FIXED] Loop with < condition:\n"); for (uint32_t i = 0; i < num_dwords_key / 4; i++) { printf(" Accessing index %u (safe)\n", i); } } int main() { printf("CVE-2025-71087 Off-by-One Vulnerability Demonstration\n"); printf("==================================================\n\n"); demonstrate_offbyone_vulnerability(); return 0; } /* * To trigger the actual vulnerability: * 1. Use a system with iavf driver loaded * 2. Configure RSS with specific key/LUT sizes * 3. The off-by-one occurs during iavf_watchdog_task execution * * KASAN will report: * BUG: KASAN: slab-out-of-bounds in iavf_config_rss+0x619/0x800 */