A poc appears to be available there : https://github.com/xnianq/cve-2021-21985_exp !
P.s. I use yandex to find CVE POC, google is almost useless for that kind of search and yandex almost always deliver working code !
P.s. I use yandex to find CVE POC, google is almost useless for that kind of search and yandex almost always deliver working code !
I'm hopefully preaching to the choir here but please beware that high-visibility flaws often attract fake PoCs. Malicious in the sense "might [also] attack the user" (you!).
Often these will surf on work done by valid PoCs to look credible. GitHub was stuffed with them for the Hafnium Exchange bug, before Microsoft brought down the ban hammer. (At the time there was lots of mewing about "Microsoft protecting their own" and "Microsoft killing free speech" but I wonder if they weren't also interested in stopping the pwnage from these fake exploits, too).
I'm not saying this repo is malicious. This github user looks legitimate and doesn't look like the obviously-created-by-a-bot profiles I've previously seen. Even so I wouldn't necessarily trust ~5000 vendored class files. Play carefully.
And have to stay away from pirated games.
A compiled executable from a trustworthy vendor gets a score of 1/65 on virustotal? Well, I guess you are running in a sandbox..
A legit library has enormous number of lines? Well I’m rolling my own (except for crypto, noone should roll their own)
I just cannot take the risk anymore.
I use those POC to help the infosec team at work when the bosses postpone patching. There is nothing like a demo to persuade them we must patch now.