/*
* PoC Concept for CVE-2026-43383
* This demonstrates the vulnerable logic vs the fix.
* Actual exploitation requires high-precision timing over the network.
*/
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
// Simulated MAC length
#define MAC_LEN 16
// Vulnerable implementation (using memcmp)
int vulnerable_mac_compare(const unsigned char *a, const unsigned char *b) {
// memcmp returns 0 on match, non-zero on mismatch.
// It exits early on the first mismatch, leaking timing info.
return memcmp(a, b, MAC_LEN) == 0;
}
// Secure implementation (Constant-time compare)
int secure_mac_compare(const unsigned char *a, const unsigned char *b) {
unsigned int result = 0;
for (int i = 0; i < MAC_LEN; i++) {
result |= a[i] ^ b[i];
}
// result is 0 only if all bytes match
return result == 0;
}
int main() {
unsigned char correct_mac[MAC_LEN] = {0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10};
unsigned char guess_mac[MAC_LEN] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
printf("Testing Vulnerable Compare:\n");
// In a real attack, an attacker measures the time taken here.
// If it returns very fast, the first byte was wrong.
if (vulnerable_mac_compare(correct_mac, guess_mac)) {
printf("MAC Match!\n");
} else {
printf("MAC Mismatch.\n");
}
printf("\nTesting Secure Compare:\n");
// This function always takes the same amount of time,
// regardless of where the mismatch occurs.
if (secure_mac_compare(correct_mac, guess_mac)) {
printf("MAC Match!\n");
} else {
printf("MAC Mismatch.\n");
}
return 0;
}