CVE-2025-15531

Executive Summary

CVE-2025-15531 is a reachable assertion vulnerability in Open5GS, an open-source implementation of the 5G Core (5GC) network. The vulnerability resides in the sgwc_bearer_add function within the src/sgwc/context.c file. By manipulating specific parameters, an attacker can trigger an assertion failure, leading to a denial of service (DoS) condition. The attack can be carried out remotely, and a public exploit is available. The vendor has flagged the issue as already-fixed, but specific patch details are not provided in the NVD data.

Impact: Successful exploitation causes the SGW-C (Serving Gateway Control plane) process to crash, disrupting 5G core network services for all connected users.

Affected Component: Open5GS SGW-C (Serving Gateway Control plane) component.

CVSS Breakdown & Threat Level

The NVD CVSS score is 0.0, indicating that a full CVSS vector has not been assigned. However, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) - The attack is carried out remotely.
• Attack Complexity (AC): Low (L) - The exploit is publicly available and likely straightforward to execute.
• Privileges Required (PR): None (N) - No authentication is required.
• User Interaction (UI): None (N) - No user interaction is needed.
• Scope (S): Unchanged (U) - The vulnerability affects only the SGW-C component.
• Confidentiality (C): None (N) - No data is exposed.
• Integrity (I): None (N) - No data is modified.
• Availability (A): High (H) - The service is completely disrupted.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Estimated Base Score: 7.5 (High)

Threat Level: High. The availability of a public exploit and the critical nature of the 5G core network make this a significant threat.

Deep Dive & Mechanics

The vulnerability is a reachable assertion in the sgwc_bearer_add function. Assertions are used in C/C++ code for debugging and to catch invalid program states during development. In production builds, assertions are often disabled. However, if the Open5GS SGW-C is compiled with assertions enabled (common in development or testing environments), an attacker can trigger a crash.

The sgwc_bearer_add function is responsible for adding a new bearer context. The vulnerability likely stems from insufficient input validation. An attacker can send a crafted GTP-C (GPRS Tunneling Protocol Control plane) message to the SGW-C, causing the function to receive unexpected or malformed data. This leads to an assertion failure, such as:

assert(bearer != NULL);

or

assert(session != NULL);

When the assertion fails, the process terminates immediately, resulting in a denial of service.

Attack Flow:

1. The attacker identifies an Open5GS SGW-C instance (e.g., via Shodan).
2. The attacker crafts a malicious GTP-C message (e.g., Create Session Request) with manipulated parameters.
3. The attacker sends the message to the SGW-C's GTP-C endpoint (typically port 2123).
4. The SGW-C processes the message, calling sgwc_bearer_add.
5. Due to the malformed input, an assertion fails.
6. The SGW-C process crashes, disrupting all active sessions and preventing new connections.

Vulnerable vs. Patched Code

The exact vulnerable and patched code is not provided in the NVD data. However, based on the description, the fix likely involves replacing the assertion with proper error handling.

Vulnerable Code (Conceptual):

void sgwc_bearer_add(sgwc_bearer_t *bearer, sgwc_session_t *session) {
    // No input validation
    assert(bearer != NULL);
    assert(session != NULL);
    // ... rest of the function
}

Patched Code (Conceptual):

int sgwc_bearer_add(sgwc_bearer_t *bearer, sgwc_session_t *session) {
    if (bearer == NULL || session == NULL) {
        // Log error and return failure
        sgwc_log_error("Invalid bearer or session");
        return -1;
    }
    // ... rest of the function
    return 0;
}

The patched version replaces the assertion with a conditional check and returns an error code, preventing the crash.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running Open5GS <= 2.7.5 with assertions enabled.
• Network access to the SGW-C GTP-C endpoint (port 2123).
• A tool to craft and send GTP-C messages (e.g., Scapy, custom Python script).

Exploit Steps:

1. Identify Target: Use Shodan or Nmap to find Open5GS instances.

   nmap -sU -p 2123 --open <target_ip>
   

2. Craft Malicious GTP-C Message: Create a Python script using Scapy to send a malformed Create Session Request.

   #!/usr/bin/env python3
   from scapy.all import *
   from scapy.contrib.gtp import *
   
   # Target IP and port
   target_ip = "192.168.1.100"
   target_port = 2123
   
   # Craft a malformed Create Session Request
   # The exact malformation depends on the vulnerable code path
   # This is a conceptual example
   pkt = IP(dst=target_ip)/UDP(sport=12345, dport=target_port)/GTPHeader(gtp_type=1)/
         GTPCreateSessionRequest(imsi="123456789012345", ...)
   
   # Send the packet
   send(pkt)
   

3. Trigger the Vulnerability: Send the crafted packet. The SGW-C should crash.

Expected Outcome: The SGW-C process terminates. All active sessions are dropped. The 5G core network becomes unavailable.

Blue Team (Detection & Defense)

Detection:

• Monitor for crashes of the sgwc process.
• Look for logs containing "Assertion failed" or "SIGABRT".
• Detect anomalous GTP-C messages with malformed fields.

Defense:

• Immediate: Update Open5GS to the latest version.
• Mitigation: If patching is not possible, disable assertions in production builds by compiling with -DNDEBUG.
• Network Segmentation: Restrict access to the SGW-C GTP-C endpoint to only trusted network elements (e.g., MME, PGW).
• Intrusion Prevention: Deploy a virtualized 5G core firewall or use SDN-based security groups to filter GTP-C traffic.

Indicators of Compromise (IOCs)

• Network IOCs:

  • GTP-C messages with invalid or unexpected fields (e.g., IMSI length, APN format).
  • UDP packets to port 2123 from untrusted IP addresses.
  • Repeated connection attempts to the SGW-C.

• System IOCs:

  • Core dump files from the sgwc process.
  • Log entries containing "Assertion failed" or "SIGABRT".
  • Process crash events in system logs (e.g., /var/log/syslog).

• File IOCs:

  • Modified or corrupted configuration files in /etc/open5gs/.

Detection Engineering

YARA Rule

rule CVE_2025_15531_Open5GS_SGWC_Assertion {
    meta:
        description = "Detects Open5GS SGW-C crash logs indicating CVE-2025-15531 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15531"
    strings:
        $assertion1 = "Assertion failed" ascii wide nocase
        $assertion2 = "SIGABRT" ascii wide nocase
        $sgwc = "sgwc" ascii wide nocase
        $bearer = "bearer_add" ascii wide nocase
    condition:
        ($assertion1 or $assertion2) and $sgwc and $bearer
}

Sigma Rule

title: Open5GS SGW-C Assertion Failure (CVE-2025-15531)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects assertion failures in Open5GS SGW-C logs, indicating potential exploitation of CVE-2025-15531.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-15531
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "Assertion failed"
        - "SIGABRT"
    condition: selection
falsepositives:
    - Legitimate crashes due to bugs in development environments
level: high

Suricata Rule

alert udp $EXTERNAL_NET any -> $HOME_NET 2123 (msg:"CVE-2025-15531 Open5GS SGW-C GTP-C Malformed Create Session Request"; content:"|48 01 00 00|"; depth:4; offset:8; content:"|00 00 00 00|"; within:4; reference:cve,2025-15531; classtype:attempted-dos; sid:1000001; rev:1;)

Note: The Suricata rule above is a conceptual example. The actual byte sequence for a malformed Create Session Request would need to be determined through reverse engineering of the vulnerable code.

Remediation & Mitigation

Immediate Actions:

1. Patch: Update Open5GS to the latest version (>= 2.7.6 or the specific commit that fixes this issue). Check the official Open5GS repository for the patch.
2. Disable Assertions: If patching is delayed, recompile Open5GS with -DNDEBUG to disable assertions in production.
3. Network Access Control: Restrict GTP-C access to only trusted network elements using firewall rules or network segmentation.

Long-Term Mitigations:

• Input Validation: Implement strict input validation for all GTP-C messages.
• Error Handling: Replace assertions with proper error handling and logging.
• Monitoring: Deploy monitoring and alerting for process crashes and anomalous GTP-C traffic.
• Security Audits: Conduct regular security audits of the 5G core network components.

Valters IT Signature:

This report was generated by Valters IT DevSecOps & CTI Expert System. For questions or further analysis, contact: security@valters.it