CVE-2025-15417

Executive Summary

CVE-2025-15417 is a denial of service (DoS) vulnerability in Open5GS, an open-source implementation of the 5G Core and EPC (Evolved Packet Core) network functions. The vulnerability resides in the GTPv2-C F-TEID (Fully Qualified Tunnel Endpoint Identifier) handler within the SGW-C (Serving Gateway Control plane) component. A local attacker can trigger a NULL pointer dereference by sending a crafted Create Session Request message, leading to a crash of the SGW-C process. The vulnerability affects Open5GS versions up to and including 2.7.6. A patch is available in the official repository. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the exploit code is publicly available, making it a risk for unpatched systems.

Supply Chain & Package Security

Open5GS is a critical component in 5G core network deployments. This vulnerability does not directly affect package managers like NPM, PyPI, Go, or Ruby, but it impacts the integrity of the 5G core software supply chain. Organizations using Open5GS in production or test environments must ensure they are running a patched version to prevent service disruption.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector (AV): Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (AC:L) – No special conditions are required.
• Privileges Required (PR): None (PR:N) – No authentication is needed.
• User Interaction (UI): None (UI:N) – No user action is required.
• Scope (S): Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality (C): None (C:N) – No data exposure.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): Low (A:L) – The attack causes a denial of service, but the impact is limited to the SGW-C process.

Threat Level: Low. The attack requires local access, but the exploit is public. In a 5G core network, local access could be achieved through a compromised network function or a malicious insider.

Deep Dive & Mechanics

The vulnerability is in the sgwc_s11_handle_create_session_request function in src/sgwc/s11-handler.c. This function processes GTPv2-C Create Session Request messages, which are used to establish a session between the SGW-C and other network elements. The issue occurs when handling the F-TEID (Fully Qualified Tunnel Endpoint Identifier) information element.

When a crafted Create Session Request is sent with a malformed or missing F-TEID, the code attempts to dereference a pointer that is NULL. This leads to a segmentation fault, crashing the SGW-C process. The crash results in a denial of service for the SGW-C, disrupting session establishment and potentially affecting connected UEs (User Equipment).

The root cause is a lack of proper validation of the F-TEID pointer before use. The patch adds a NULL check to prevent the dereference.

Vulnerable vs. Patched Code

Vulnerable Code (before patch):

// src/sgwc/s11-handler.c
static void sgwc_s11_handle_create_session_request(
        sgwc_s11_t *s11, ogs_gtp2_message_t *message)
{
    // ...
    ogs_gtp2_f_teid_t *f_teid = message->create_session_request.f_teid;
    // No NULL check before dereference
    ogs_assert(f_teid);
    // ...
    // Use f_teid->ipv4 or f_teid->ipv6
}

Patched Code (after commit 465273d13ba5d47b274c38c9d1b07f04859178a1):

// src/sgwc/s11-handler.c
static void sgwc_s11_handle_create_session_request(
        sgwc_s11_t *s11, ogs_gtp2_message_t *message)
{
    // ...
    ogs_gtp2_f_teid_t *f_teid = message->create_session_request.f_teid;
    // Added NULL check
    if (f_teid == NULL) {
        ogs_error("No F-TEID in Create Session Request");
        return;
    }
    // ...
    // Safe to use f_teid
}

The patch adds a simple NULL check. If f_teid is NULL, the function logs an error and returns early, preventing the crash.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to the Open5GS SGW-C host.
• Ability to send GTPv2-C messages (e.g., using a tool like gtp5g or a custom script).
• Open5GS version <= 2.7.6.

Exploit Steps:

1. Identify the SGW-C IP address and port (default: 2123 for GTPv2-C).
2. Craft a GTPv2-C Create Session Request message with a missing or malformed F-TEID IE.
3. Send the message to the SGW-C.
4. The SGW-C process crashes, causing a denial of service.

Example Python script using Scapy:

from scapy.all import *
from scapy.contrib.gtp import *

# Craft a GTPv2-C Create Session Request without F-TEID
pkt = IP(dst="192.168.1.100")/UDP(sport=2123, dport=2123)/GTPHeader(gtp_type=0x20)/
    GTPCreateSessionRequest(teid=0x00000001, imsi="123456789012345", 
    msisdn="1234567890", apn="internet")

# Send the packet
send(pkt)

Note: The exact packet structure may vary. The key is to omit the F-TEID IE.

Blue Team

Detection:

• Monitor SGW-C logs for errors like No F-TEID in Create Session Request (after patch) or segmentation faults.
• Use network monitoring to detect malformed GTPv2-C messages.
• Implement rate limiting on GTPv2-C messages.

Mitigation:

• Apply the patch immediately.
• Restrict local access to the SGW-C host.
• Use a Web Application Firewall (WAF) or intrusion detection system (IDS) to filter malformed GTPv2-C messages.

Indicators of Compromise (IOCs)

• Network IOCs:
  • GTPv2-C Create Session Request messages with missing or malformed F-TEID IE.
  • Source IP addresses sending such malformed messages.
• Host IOCs:
  • SGW-C process crash logs.
  • Core dumps from the SGW-C process.
  • Error messages in /var/log/open5gs/sgwc.log indicating a NULL pointer dereference.

Detection Engineering

YARA Rule

rule CVE_2025_15417_Open5GS_SGWC_DoS {
    meta:
        description = "Detects Open5GS SGW-C binary with vulnerable code pattern"
        author = "Valters IT"
        date = "2025-03-01"
        reference = "CVE-2025-15417"
    strings:
        $vuln_code = "ogs_assert(f_teid)" ascii wide
        $patched_code = "if (f_teid == NULL)" ascii wide
    condition:
        $vuln_code and not $patched_code
}

Sigma Rule

title: CVE-2025-15417 - Open5GS SGW-C DoS via Malformed GTPv2-C
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects malformed GTPv2-C Create Session Request messages targeting Open5GS SGW-C
author: Valters IT
date: 2025-03-01
logsource:
    category: network
    product: suricata
detection:
    selection:
        app_protocol: gtp
        gtp.message_type: 0x20  # Create Session Request
        gtp.f_teid_present: false
    condition: selection
falsepositives:
    - Legitimate GTPv2-C messages with missing F-TEID (rare)
level: high

Suricata Rule

alert udp any any -> any 2123 (msg:"CVE-2025-15417 - Open5GS SGW-C DoS via Malformed GTPv2-C"; 
    content:"|20|"; offset:0; depth:1; 
    content:"|00 01|"; distance:0; within:2; 
    pcre:"/^.{8}\x20/"; 
    sid:1000001; rev:1;)

Note: The Suricata rule is a basic example. A more precise rule would require deep packet inspection of the GTPv2-C message structure.

Remediation & Mitigation

1. Apply the Patch: Update Open5GS to a version that includes commit 465273d13ba5d47b274c38c9d1b07f04859178a1 or later.
2. Restrict Local Access: Limit access to the SGW-C host to trusted users and processes.
3. Network Segmentation: Isolate the SGW-C in a secure network segment.
4. Monitoring: Implement logging and monitoring for GTPv2-C messages.
5. Rate Limiting: Apply rate limiting on GTPv2-C messages to mitigate DoS attacks.

Valters IT