CVE-2026-41564: CryptX Perl模块PRNG状态重用漏洞

#!/usr/bin/perl use CryptX; use strict; use warnings; # Vulnerable Scenario: Create object BEFORE fork my $rsa = Crypt::PK::RSA->new(); # Simulate a preforking server creating workers for my $i (1..2) { my $pid = fork(); die "Cannot fork" unless defined $pid; if ($pid == 0) { # Child process performing cryptographic operations my $priv = Crypt::PK::RSA->new(); # In real vuln, reused 'rsa' object or shared state leads to identical k-values/nonce # If keys are generated or signatures are created, they may share entropy. # Example: Generating a key (vulnerable if PRNG state is identical) $priv->generate_key(256); print "Worker $i generated key fingerprint: " . $priv->key2hash()->{kid_hex} . "\n"; exit 0; } } 1 while wait() != -1; print "Exploit simulation complete. Check if keys/signatures collide.\n";