CVE-2026-40243 Incus OVN TLS验证绕过漏洞

/* * Conceptual PoC: Vulnerable Verification Logic * This Go snippet demonstrates the flawed logic where the trust root * is constructed from the peer's certificates instead of a configured CA. */ package main import ( "crypto/tls" "crypto/x509" ) func vulnerableVerifyPeerCertificate(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error { // VULNERABLE LOGIC: Creating a new CertPool and adding the peer's raw certs // This effectively trusts any certificate presented by the attacker. roots := x509.NewCertPool() for _, rawCert := range rawCerts { cert, err := x509.ParseCertificate(rawCert) if err != nil { return err } roots.AddCert(cert) // Adding attacker's cert as a trusted root } opts := x509.VerifyOptions{ Roots: roots, // Using the compromised pool } // Verify the chain using the attacker-supplied roots if len(verifiedChains) > 0 { _, err := verifiedChains[0][0].Verify(opts) return err } return nil } // This function would be passed to tls.Config{VerifyPeerCertificate: ...} func main() { cfg := &tls.Config{ InsecureSkipVerify: true, VerifyPeerCertificate: vulnerableVerifyPeerCertificate, } _ = cfg }