来源

关联漏洞

描述

Note: I am not responsible for any bad act. This is written by Chirag Artani to demonstrate the vulnerability.

介绍

Please note: Some intellectual thinks this is the real bug and exploit (you can understand how much intellect they are) but the script clerly says at the header - 'IPv6 Vulnerability Simulation Script'. Please remember this is only giving an idea about how it can cause crash (in simple word) and lead to RCE.


This should be on to perform the proof of concept and also you need flask  order to test/verify the bug.

Integer Overflow
In the ```process_packet``` function, the vulnerability occurs when calculating the ```total_length```:

```
total_length = packet.main_header_length
for header_length in packet.extension_headers:
    total_length += header_length
```
    
If the sum of these lengths becomes larger than the maximum value an integer can hold (2^31 - 1 for a 32-bit signed integer), it will wrap around to a negative number. This is the integer overflow.
Buffer Overflow
The integer overflow leads to a buffer overflow in this line:
```
for i in range(total_length):
    buffer[i] = 0xFF  # Potential out-of-bounds write
```
If ```total_length``` becomes negative due to integer overflow, it will be interpreted as a very large positive number by ```range()```. This causes the loop to write far beyond the end of the ```buffer```, which only has 64 bytes allocated.

### Real-World Implications
In a real system, this could lead to:

1. Overwriting adjacent memory
2. Crashing the application
3. Potential arbitrary code execution if an attacker can control the overwritten memory

This is written by Chirag Artani and if you have bad intension , you are responsible for any bad/malicious activity.

Enable it => Most probably this is enabled bydefault. 

![Screenshot_1](https://github.com/user-attachments/assets/01d8da94-6dbc-49eb-86b0-6c52d97f5073)

<mark>Check the ```CVE-2024-38063-poc.py``` for more, everything will be perform using flask python, crashing the ipv6 flowing it over passing commands and getting things executed.<mark>

Thank You!
- Chirag Artani

文件快照

 [4.0K]  /data/pocs/848f914a1c68c66a15789ee65b1a9cb2de22bab6
├── [3.3K]  CVE-2024-38063-poc.py
├── [1.9K]  README.md
└── [153K]  Screenshot_1.png

0 directories, 3 files

备注