CVE-2026-31649: Linux内核stmmac驱动整数下溢漏洞

/* * Conceptual Proof of Concept for CVE-2026-31649 * Demonstrating the integer underflow logic. */ #include <stdio.h> #include <stdint.h> #define BUF_SIZE_8KiB 8192 void simulate_vulnerable_logic(uint32_t linear_len, uint32_t total_len) { printf("[+] Simulating stmmac jumbo_frm logic\n"); printf(" Linear length (nopaged_len): %u\n", linear_len); printf(" Total length (skb->len): %u\n", total_len); printf(" Buffer size (bmax): %u\n", BUF_SIZE_8KiB); // The check in stmmac_xmit uses total_len int is_jumbo = (total_len > BUF_SIZE_8KiB); if (is_jumbo) { printf(" [!] Packet identified as Jumbo Frame. Calling jumbo_frm()...\n"); // VULNERABLE CALCULATION in jumbo_frm() // It uses linear_len, not total_len uint32_t len = linear_len - BUF_SIZE_8KiB; printf(" [VULN] Calculated len = %u - %u = %u (0x%x)\n", linear_len, BUF_SIZE_8KiB, len, len); if (len > 100000) { printf(" [!!!] Integer Underflow detected! Loop will run excessively.\n"); printf(" [!!!] This would map arbitrary kernel memory to DMA.\n"); } } } int main() { // Scenario: Small linear data, huge total data (via fragments) // This triggers the jumbo check but causes underflow in calculation simulate_vulnerable_logic(100, 9000); return 0; }