Linux内核rtw88驱动内存泄漏漏洞 (CVE-2025-71273)

/* * PoC Concept for CVE-2025-71273 * Demonstrates the memory leak logic in the rtw88 driver. */ #include <linux/module.h> #include <linux/slab.h> // Simulated structure for the device struct rtw_dev { void *supported_band; }; // Vulnerable function simulation int vulnerable_rtw_set_supported_band(struct rtw_dev *rtwdev) { // Allocation happens here (vulnerable point) rtwdev->supported_band = kmalloc(1024, GFP_KERNEL); if (!rtwdev->supported_band) return -ENOMEM; return 0; } // Vulnerable path simulation int vulnerable_rtw_register_hw(struct rtw_dev *rtwdev) { int ret = vulnerable_rtw_set_supported_band(rtwdev); if (ret) return ret; // Success path returns 0 // Simulate an error occurring after allocation // The function returns error, but 'supported_band' is not freed. return -ENODEV; } // Exploitation: Repeatedly calling the init function that fails // will leak 1024 bytes each time.