CVE-2026-31780: Linux内核wilc1000驱动堆缓冲区溢出

/* * PoC Concept for CVE-2026-31780 * This code demonstrates the logic error causing the overflow. * Compile: gcc -o poc poc.c */ #include <stdio.h> #include <stdint.h> #include <stdlib.h> #define WILC_MAX_NUM_PROBED_SSID 10 #define IEEE80211_MAX_SSID_LEN 32 // Vulnerable logic simulation void simulate_vulnerability() { uint8_t valuesize = 0; // Vulnerable type u8 int total_ssid_len = WILC_MAX_NUM_PROBED_SSID * (IEEE80211_MAX_SSID_LEN + 1); printf("[+] Simulating SSID size calculation...\n"); for (int i = 0; i < WILC_MAX_NUM_PROBED_SSID; i++) { valuesize += (IEEE80211_MAX_SSID_LEN + 1); } printf("[+] Calculated size (u8): %d\n", valuesize); printf("[+] Actual required size: %d\n", total_ssid_len); if (valuesize < total_ssid_len) { printf("[!] Integer overflow detected! Allocating %d bytes but writing %d bytes.\n", valuesize, total_ssid_len); // Simulating the kmalloc and memcpy behavior char *buffer = (char *)malloc(valuesize + 1); if (buffer) { char dummy_data[400]; // Source data larger than buffer memset(dummy_data, 'A', sizeof(dummy_data)); // This would cause heap overflow in the kernel // memcpy(buffer, dummy_data, total_ssid_len); printf("[!] In Kernel: memcpy(dst, src, %d) overflows buffer of size %d\n", total_ssid_len, valuesize); free(buffer); } } } int main() { simulate_vulnerability(); return 0; }