CVE-2026-43112 Linux内核SMB越界读取漏洞

#include <stdio.h> #include <string.h> #include <stdlib.h> // Simulated vulnerable logic based on the description char* cifs_sanitize_prepath_vulnerable(const char *path) { if (!path) return NULL; char *cursor = (char *)path; char *cursor2 = (char *)path; // Strip prepended delimiters while (*cursor == '/') { cursor++; } // Vulnerability: If input was only "/", cursor is at end (null terminator), // but cursor2 is still at the start. // The original logic checked *(cursor2 - 1) before cursor2 advanced. if (*cursor == '\0') { // This simulates the problematic check mentioned in the CVE description // checking *(cursor2 - 1) when cursor2 is at base address. char prev_char = *(cursor2 - 1); // Out-of-bounds read happens here printf("Read char before buffer: %c\n", prev_char); } return NULL; } int main() { // Trigger input: string containing only delimiters char *malicious_path = strdup("/"); printf("Testing CVE-2026-43112 PoC with input: '%s'\n", malicious_path); cifs_sanitize_prepath_vulnerable(malicious_path); free(malicious_path); return 0; }