CVE-2025-14954

Executive Summary

CVE-2025-14954 is a denial-of-service (DoS) vulnerability in Open5GS, an open-source implementation of the 5G Core (5GC) network functions. The vulnerability resides in the PFCP (Packet Forwarding Control Protocol) context management library (lib/pfcp/context.c). Specifically, the functions ogs_pfcp_pdr_find_or_add, ogs_pfcp_far_find_or_add, ogs_pfcp_urr_find_or_add, and ogs_pfcp_qer_find_or_add contain reachable assertions that can be triggered by a remote attacker. By sending a specially crafted PFCP message, an attacker can cause the Open5GS process to crash, leading to a denial of service. The attack complexity is high, and exploitability is considered difficult, but a public proof-of-concept exists. The vendor has released a patch (commit 442369dcd964f03d95429a6a01a57ed21f7779b7) to address this issue.

Supply Chain & Package Security

This vulnerability affects the Open5GS project, which is distributed as source code and via package managers for various Linux distributions. Users who have deployed Open5GS from source or via packages (e.g., from the Open5GS APT repository) are affected. The supply chain risk is moderate, as the vulnerability is in the core PFCP library, which is a fundamental component of the 5G core network functions (SMF, UPF, etc.). An attacker exploiting this could disrupt 5G core services.

CVSS Breakdown & Threat Level

• CVSS Score: 3.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector (AV): Network (N) - The attack can be launched remotely over the network.
• Attack Complexity (AC): High (H) - The attack requires specific conditions or knowledge of the target's state.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): None (N) - No data is exposed.
• Integrity (I): None (N) - No data is modified.
• Availability (A): Low (L) - The attack can cause a denial of service (process crash).

Threat Level: Low. The high attack complexity and low availability impact reduce the immediate risk. However, in a production 5G core environment, a DoS on the SMF or UPF could disrupt service for many users.

Deep Dive & Mechanics

The vulnerability is located in the PFCP context management functions within lib/pfcp/context.c. PFCP is used between the SMF (Session Management Function) and UPF (User Plane Function) in a 5G core to establish and manage user plane sessions. The functions ogs_pfcp_pdr_find_or_add, ogs_pfcp_far_find_or_add, ogs_pfcp_urr_find_or_add, and ogs_pfcp_qer_find_or_add are responsible for finding or creating PFCP session objects (PDR, FAR, URR, QER).

The issue is that these functions contain assertions (e.g., ogs_assert(...)) that are reachable via malformed or unexpected PFCP messages. When an assertion fails, the program terminates abruptly, causing a denial of service. The manipulation leads to a reachable assertion, meaning the attacker can craft a PFCP message that causes the code to hit an ogs_assert statement with a false condition.

The attack is initiated remotely by sending a PFCP message to the target (likely the SMF or UPF). The complexity is high because the attacker needs to understand the PFCP protocol and the internal state of the Open5GS instance to trigger the assertion.

Vulnerable vs. Patched Code

The patch commit 442369dcd964f03d95429a6a01a57ed21f7779b7 addresses the issue by replacing the reachable assertions with proper error handling. Instead of crashing on an assertion failure, the patched code returns an error code or handles the unexpected condition gracefully.

Vulnerable Code (simplified):

void* ogs_pfcp_pdr_find_or_add(ogs_pfcp_sess_t *sess, ...) {
    // ... some logic ...
    ogs_assert(some_condition); // This can be triggered by a malformed message
    // ... rest of function ...
}

Patched Code (simplified):

ogs_pfcp_pdr_t* ogs_pfcp_pdr_find_or_add(ogs_pfcp_sess_t *sess, ...) {
    // ... some logic ...
    if (!some_condition) {
        ogs_error("Invalid PFCP message");
        return NULL; // Graceful error handling
    }
    // ... rest of function ...
}

The patch changes the assertion to a conditional check that logs an error and returns a failure indicator instead of crashing.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running Open5GS version <= 2.7.6 with PFCP enabled (e.g., SMF or UPF).
• Network access to the PFCP port (default 8805).
• Understanding of PFCP message structure.

Exploitation Steps:

1. Identify Target: Scan for Open5GS instances on port 8805 (PFCP).
2. Craft Malformed PFCP Message: Create a PFCP message that triggers the assertion in one of the vulnerable functions. This could involve sending a PFCP Session Establishment Request with an invalid or unexpected combination of PDR/FAR/URR/QER IDs.
3. Send Message: Send the crafted PFCP message to the target.
4. Observe Crash: The target process (e.g., open5gs-smfd or open5gs-upfd) will crash due to the assertion failure, causing a denial of service.

Example (Conceptual):

# This is a conceptual example. Actual exploitation requires deep PFCP knowledge.
import socket

# Craft a malformed PFCP message (simplified)
pfcp_message = b"\x20\x02\x00\x2a"  # PFCP Session Establishment Request header
# ... add malformed PDR/FAR/URR/QER IE ...

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(pfcp_message, ("target_ip", 8805))
sock.close()

Blue Team

Detection:

• Monitor for crashes of Open5GS processes (open5gs-smfd, open5gs-upfd).
• Look for PFCP messages with invalid or unexpected IE combinations.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Apply the patch immediately (commit 442369dcd964f03d95429a6a01a57ed21f7779b7).
• Restrict network access to PFCP ports (8805) to trusted SMF/UPF nodes only.
• Implement network segmentation to isolate the 5G core network.
• Use a Web Application Firewall (WAF) or intrusion detection system (IDS) to filter malformed PFCP traffic.

Indicators of Compromise (IOCs)

• Network IOCs:
  • PFCP messages with invalid or unexpected PDR/FAR/URR/QER IE combinations.
  • Repeated PFCP Session Establishment Requests from a single source.
• System IOCs:
  • Core dumps from open5gs-smfd or open5gs-upfd processes.
  • Log entries containing ogs_assert failures in the Open5GS logs.
  • Unexpected process restarts of Open5GS services.

Detection Engineering

YARA Rule

rule CVE_2025_14954_Open5GS_PFCP_Assertion {
    meta:
        description = "Detects PFCP messages that may trigger assertion failure in Open5GS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14954"
    strings:
        $pfcp_header = { 20 ?? ?? ?? }  // PFCP message header
        $pdr_ie = { 00 3C }  // PDR IE type
        $far_ie = { 00 3D }  // FAR IE type
        $urr_ie = { 00 3E }  // URR IE type
        $qer_ie = { 00 3F }  // QER IE type
    condition:
        $pfcp_header and (any of ($pdr_ie, $far_ie, $urr_ie, $qer_ie))
}

Sigma Rule

title: CVE-2025-14954 - Open5GS PFCP Assertion DoS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2025-14954 via PFCP messages
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/open5gs-smfd'
            - '/open5gs-upfd'
        CommandLine|contains: 'assert'
    condition: selection
falsepositives:
    - Legitimate debugging with assertions enabled
level: high

Suricata Rule

alert udp any any -> any 8805 (msg:"CVE-2025-14954 - Open5GS PFCP Assertion DoS Attempt"; content:"|20|"; offset:0; depth:1; content:"|00 3C|"; distance:0; within:2; sid:1000001; rev:1;)

Remediation & Mitigation

1. Apply Patch: Immediately update Open5GS to a version that includes the fix (commit 442369dcd964f03d95429a6a01a57ed21f7779b7 or later). Rebuild and redeploy all affected components (SMF, UPF).
2. Network Segmentation: Restrict access to PFCP ports (8805) to only trusted SMF and UPF nodes using firewall rules.
3. Monitoring: Implement monitoring for Open5GS process crashes and unusual PFCP traffic.
4. IDS/IPS: Deploy the Suricata rule provided to detect and block malicious PFCP messages.
5. Least Privilege: Ensure that Open5GS processes run with the minimum necessary privileges.

Valters IT