CVE-2025-71133: Linux内核irdma驱动越界读取漏洞

/* * PoC for CVE-2025-71133: irdma_net_event out-of-bounds read * This PoC triggers the vulnerability by causing a NETEVENT_NEIGH_UPDATE * event that will be processed by irdma driver. * * Note: This is a kernel-level vulnerability, PoC requires kernel module * or specific network configuration to trigger. */ #include <linux/kernel.h> #include <linux/module.h> #include <linux/netdevice.h> #include <net/neighbour.h> MODULE_LICENSE("GPL"); MODULE_AUTHOR("PoC Author"); MODULE_DESCRIPTION("CVE-2025-71133 PoC"); /* * The vulnerable code pattern in irdma_net_event(): * * static int irdma_net_event(struct notifier_block *nb, unsigned long event, void *ptr) * { * struct neighbour *neigh = ptr; // <-- Direct assignment without type check * struct net_device *dev = neigh->dev; // <-- Out-of-bounds read here * * switch (event) { * case NETEVENT_NEIGH_UPDATE: * // ... process update * break; * default: * break; * } * } * * Trigger mechanism: * 1. Configure IPv6 routing to trigger ICMPv6 redirect * 2. The redirect handler calls rt6_do_redirect() * 3. rt6_do_redirect() calls notifier_call_chain() * 4. irdma_net_event() receives non-NETEVENT_NEIGH_UPDATE event * 5. KASAN detects stack-out-of-bounds read */ static int __init cve_2025_71133_init(void) { printk(KERN_INFO "CVE-2025-71133 PoC module loaded\n"); /* * In practice, this vulnerability is triggered through network events, * not by loading a module. The PoC involves: * - Having irdma driver loaded * - IPv6 neighbor discovery triggering redirect * - KASAN-enabled kernel detecting the out-of-bounds access */ return 0; } static void __exit cve_2025_71133_exit(void) { printk(KERN_INFO "CVE-2025-71133 PoC module unloaded\n"); } module_init(cve_2025_71133_init); module_exit(cve_2025_71133_exit);