CVE-2026-43172: Linux内核iwlwifi驱动数组越界漏洞

/** * PoC Concept for CVE-2026-43172 * Triggering the bug requires a modified firmware image or * a tool to inject malformed SMEM data to the iwlwifi driver. * This C code simulates the missing bounds check logic. */ #include <stdio.h> #include <stdlib.h> #define MAX_LMACS 2 struct smem_cfg { int lmac[MAX_LMACS]; }; // Simulated vulnerable function void iwl_parse_smem(struct smem_cfg *cfg, int num_lmacs) { printf("Parsing SMEM with %d LMACs\n", num_lmacs); // VULNERABILITY: Missing check for (num_lmacs > MAX_LMACS) // If num_lmacs is 3, accessing lmac[2] is an out-of-bounds read/write. if (num_lmacs > 0) { int val = cfg->lmac[num_lmacs - 1]; // Out of bounds here if num_lmacs > 2 printf("Accessed lmac[%d] = %d\n", num_lmacs - 1, val); } } int main() { struct smem_cfg my_cfg = {0}; // Normal case: 2 LMACs iwl_parse_smem(&my_cfg, 2); // Trigger case: 3 LMACs (Causes array overrun) printf("\nTriggering Vulnerability:\n"); iwl_parse_smem(&my_cfg, 3); return 0; }