CVE-2026-43277 Linux内核GHES越界读取漏洞

/* * PoC Concept for CVE-2026-43277 * This simulates the vulnerable logic in ghes_new() where the CPER record length * is not checked against the actual allocated memory size. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #define GHES_ESTATUS_MAX_SIZE 65536 // 64KB void simulate_vulnerability(size_t record_len, size_t allocated_size) { // Simulate allocation based on firmware table pages (could be smaller than requested) char *buffer = (char *)malloc(allocated_size); if (!buffer) { perror("malloc failed"); return; } printf("[+] Allocated buffer: %zu bytes\n", allocated_size); printf("[+] Malicious CPER record length: %zu bytes\n", record_len); // Check 1: Original code checks if record > MAX_SIZE (Passes here) if (record_len > GHES_ESTATUS_MAX_SIZE) { printf("[-] Record rejected: Exceeds GHES_ESTATUS_MAX_SIZE\n"); free(buffer); return; } // Vulnerability: Missing check for (record_len > allocated_size) // In the real kernel, accessing 'buffer' beyond 'allocated_size' causes a page fault. printf("[!] Attempting to access buffer beyond allocated size...\n"); // This loop simulates the kernel reading the record (e.g., in hex_dump_to_buffer) for (size_t i = 0; i < record_len; i++) { // Accessing memory outside the allocated block triggers the crash volatile char c = buffer[i]; if (i == allocated_size) { printf("[!!!] OOPS: Access violation at offset %zu (Boundary crossed!)\n", i); } } free(buffer); } int main() { // Scenario: Firmware allocates 1 page (4KB) but sends a 8KB record size_t alloc_size = 4096; size_t malicious_len = 8192; simulate_vulnerability(malicious_len, alloc_size); return 0; }