CVE-2025-14953

Executive Summary

CVE-2025-14953 is a null pointer dereference vulnerability in Open5GS, an open-source implementation of the 5G Core network. The flaw resides in the ogs_pfcp_handle_create_pdr function within lib/pfcp/handler.c, specifically in the FAR-ID Handler component. An attacker can remotely trigger a null pointer dereference by sending a crafted PFCP (Packet Forwarding Control Protocol) message with a manipulated FAR-ID, leading to a denial of service (DoS) condition. The attack complexity is high, and the exploit is publicly available. A patch has been released in commit 93a9fd98a8baa94289be3b982028201de4534e32.

Supply Chain & Package Security

Open5GS is a critical component in 5G core network deployments, often used in research, testing, and production environments. The vulnerability is in the core library (lib/pfcp), which is a fundamental part of the PFCP protocol handling. Organizations using Open5GS should verify their supply chain integrity and ensure they are using a patched version. The package is typically distributed via GitHub releases and Docker images.

CVSS Breakdown & Threat Level

• CVSS Score: 3.1 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector (AV): Network (N) - The attack can be launched remotely.
• Attack Complexity (AC): High (H) - The attack requires specific conditions or knowledge.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): None (N) - No data exposure.
• Integrity (I): None (N) - No data modification.
• Availability (A): Low (L) - The vulnerability can cause a denial of service.

Threat Level: Low. The high attack complexity and low impact (availability only) reduce the immediate risk. However, the public availability of the exploit increases the threat for targeted attacks.

Deep Dive & Mechanics

The vulnerability is a classic null pointer dereference in the PFCP handler. The function ogs_pfcp_handle_create_pdr processes PFCP messages to create Packet Detection Rules (PDRs). When handling the FAR-ID (Forwarding Action Rule ID), the code fails to properly validate the pointer before dereferencing it. An attacker can craft a PFCP message with a malformed or missing FAR-ID, causing the code to attempt to read from a null pointer, resulting in a crash.

The vulnerable code path is in lib/pfcp/handler.c. The function ogs_pfcp_handle_create_pdr is called when a PFCP session establishment request is received. The FAR-ID is used to link a PDR to a FAR. If the FAR-ID is not properly set or is invalid, the code may attempt to access a null pointer.

Vulnerable vs. Patched Code

Vulnerable Code (before patch):

// lib/pfcp/handler.c (simplified)
void ogs_pfcp_handle_create_pdr(ogs_pfcp_node_t *node, ogs_pfcp_message_t *message) {
    ogs_pfcp_pdr_t *pdr = message->pdr;
    // ... other code ...
    if (pdr->far_id) {  // Missing null check on pdr itself
        // ... process far_id ...
    }
    // Potential null pointer dereference if pdr is NULL
    ogs_pfcp_far_t *far = pdr->far;  // pdr could be NULL
    // ...
}

Patched Code (after commit 93a9fd98a8baa94289be3b982028201de4534e32):

// lib/pfcp/handler.c (simplified)
void ogs_pfcp_handle_create_pdr(ogs_pfcp_node_t *node, ogs_pfcp_message_t *message) {
    ogs_pfcp_pdr_t *pdr = message->pdr;
    // ... other code ...
    if (pdr == NULL) {  // Added null check
        ogs_error("Invalid PDR");
        return;
    }
    if (pdr->far_id) {
        // ... process far_id ...
    }
    ogs_pfcp_far_t *far = pdr->far;  // Safe now
    // ...
}

The patch adds a null pointer check for pdr before dereferencing it, preventing the null pointer dereference.

Exploitation & Lab Setup

Red Team

Exploit Description: The exploit involves sending a crafted PFCP message to the Open5GS SMF (Session Management Function) or UPF (User Plane Function) that triggers the vulnerable code path. The attack requires knowledge of the PFCP protocol and the ability to send raw packets to the target.

Lab Setup:

1. Target: Deploy Open5GS version 2.7.5 or earlier in a controlled environment.
2. Attacker: Use a machine with tools like scapy or a custom PFCP fuzzer.
3. Network: Ensure network connectivity between attacker and target (e.g., same subnet).

Exploit Steps:

1. Craft a PFCP Session Establishment Request with a malformed PDR that has a null or invalid FAR-ID.
2. Send the packet to the target's PFCP port (default 8805).
3. Monitor the target for crashes or service disruption.

Example Scapy Script (Conceptual):

from scapy.all import *
from scapy.contrib.pfcp import *

# Craft a PFCP packet with a malformed PDR
pdr = PFCP_PDR(far_id=None)  # Null FAR-ID
pfcp_pkt = PFCP(version=1, msg_type=PFCP_SESSION_ESTABLISHMENT_REQUEST) / pdr

# Send to target
send(pfcp_pkt, iface="eth0")

Blue Team

Detection:

• Monitor for PFCP packets with malformed or missing FAR-IDs.
• Look for crashes in the Open5GS logs (e.g., ogs_pfcp_handle_create_pdr errors).
• Use network monitoring to detect anomalous PFCP traffic.

Mitigation:

• Apply the patch immediately.
• Restrict network access to PFCP ports (8805) to trusted sources only.
• Implement network segmentation to isolate 5G core components.

Indicators of Compromise (IOCs)

• Network:
  • PFCP packets with invalid or missing FAR-ID fields.
  • Repeated PFCP Session Establishment Requests from a single source.
• Host:
  • Open5GS service crashes or restarts.
  • Log entries containing ogs_pfcp_handle_create_pdr and null pointer errors.
  • Core dumps from the ogs-upf or ogs-smf processes.

Detection Engineering

YARA Rule

rule CVE_2025_14953_Open5GS_Null_Pointer {
    meta:
        description = "Detects null pointer dereference in Open5GS PFCP handler"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-14953"
    strings:
        $s1 = "ogs_pfcp_handle_create_pdr" ascii wide nocase
        $s2 = "far_id" ascii wide nocase
        $s3 = "pdr->far" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-14953 - Open5GS PFCP Null Pointer Dereference
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2025-14953 via PFCP traffic
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: pfcp
detection:
    selection:
        pfcp.msg_type: 'Session Establishment Request'
        pfcp.pdr.far_id: null
    condition: selection
falsepositives:
    - Legitimate PFCP traffic with missing FAR-ID (rare)
level: high

Suricata Rule

alert udp any any -> any 8805 (msg:"CVE-2025-14953 Open5GS PFCP Null Pointer Dereference"; content:"|20 1c|"; offset:0; depth:2; content:"|00 00|"; within:4; pcre:"/\\x00\\x00.{2}\\x00\\x00/"; sid:1000001; rev:1;)

Note: The Suricata rule is a simplified example. A real rule would need to parse the PFCP message structure more precisely.

Remediation & Mitigation

1. Immediate Patch: Apply the patch from commit 93a9fd98a8baa94289be3b982028201de4534e32 or upgrade to Open5GS version 2.7.6 or later.
2. Network Controls: Restrict access to PFCP ports (8805) using firewalls or network policies.
3. Monitoring: Implement the detection rules above to identify exploitation attempts.
4. Least Privilege: Run Open5GS services with minimal necessary privileges.
5. Backup: Ensure backups of configuration and data are available for recovery.

Valters IT