CVE-2025-71104 Linux内核KVM x86虚拟机定时器硬锁漏洞

// CVE-2025-71104 PoC - KVM VM Hard Lockup Trigger // This PoC demonstrates the vulnerability by suspending a VM for extended duration #include <stdio.h> #include <stdlib.h> #include <unistd.h> /* * Prerequisites: * 1. Intel CPU with VMX enabled * 2. Linux kernel with KVM modules loaded (kvm, kvm_intel) * 3. A VM running with HV timer (VMX preemption timer) enabled * 4. Guest OS with periodic APIC timer (e.g., Windows VM) * * Steps to trigger: * 1. Start a VM with periodic APIC timer active * 2. Suspend/pause the VM for extended duration (hours or more) * 3. Resume the VM * 4. Observe potential hard lockup on host with NMI watchdog alert * * Expected behavior: * - VM resumes with massive timer IRQ backlog * - Host system may lock up completely * - Kernel panic with 'Watchdog detected hard LOCKUP' * * This is a LOCAL attack requiring: * - AV:L (Local access) * - PR:L (Low privileges) * - UI:N (No user interaction required after setup) */ int main() { printf("[*] CVE-2025-71104 KVM VM Hard Lockup PoC\n"); printf("[*] Target: Linux kernel KVM/x86 with VMX preemption timer\n\n"); printf("[!] This vulnerability is triggered by suspending a VM for extended duration\n"); printf("[!] Steps:\n"); printf("[!] 1. Run a VM with periodic APIC timer (Intel CPU + HV timer)\n"); printf("[!] 2. Suspend/hibernate the host or pause the VM\n"); printf("[!] 3. Wait for extended period (hours/days)\n"); printf("[!] 4. Resume VM - triggers unbounded timer IRQs\n"); printf("[!] 5. Host may hard lockup with NMI watchdog alert\n\n"); printf("[*] Vulnerability is in kvm/x86/apic.c advance_periodic_target_expiration()\n"); printf("[*] Fix: Set expiration to 'now' when target is in the past\n"); return 0; }