CVE-2025-71109: Linux内核MIPS架构ftrace缓冲区溢出漏洞

// CVE-2025-71109 PoC - MIPS Kernel ftrace Buffer Overflow Trigger // This PoC demonstrates the condition that triggers the vulnerability // Requires: MIPS architecture Linux kernel with kernel image beyond 32-bit address space #include <stdio.h> #include <unistd.h> #include <sys/syscall.h> // Trigger condition: MIPS kernel with ftrace enabled and kernel beyond 32-bit // The vulnerability occurs when ftrace tries to trace functions in kernels // located beyond 32-bit address space, causing buffer overflow in int[2] array int main() { printf("CVE-2025-71109 PoC - MIPS ftrace Buffer Overflow\n"); printf("Target: Linux Kernel MIPS with ftrace enabled\n"); printf("Trigger: Kernel image located beyond 32-bit address space\n\n"); // Check system architecture FILE *cpuinfo = fopen("/proc/cpuinfo", "r"); if (cpuinfo) { char line[256]; while (fgets(line, sizeof(line), cpuinfo)) { if (strstr(line, "cpu model") || strstr(line, "isa")) { printf("%s", line); } } fclose(cpuinfo); } // Check if kernel is 64-bit (required for 32-bit overflow scenario) struct utsname uts; if (uname(&uts) == 0) { printf("System: %s\n", uts.sysname); printf("Release: %s\n", uts.release); printf("Machine: %s\n", uts.machine); } printf("\nNote: This vulnerability is triggered during kernel boot\n"); printf("when ftrace attempts to instrument functions in kernels\n"); printf("located beyond 32-bit address space.\n"); printf("\nObserved symptom: __cpu_primary_thread_mask corruption\n"); printf("Result: System hang during early boot phase\n"); return 0; }