CVE-2025-15532

Executive Summary

CVE-2025-15532 is a publicly disclosed denial-of-service (DoS) vulnerability affecting Open5GS, an open-source 5G Core network implementation. The flaw resides in the Timer Handler component, where improper handling of timer events can lead to excessive resource consumption. An unauthenticated attacker can trigger this condition remotely, causing the targeted network function to become unresponsive. The vulnerability affects all versions up to and including 2.7.5. A patch is available via commit c7c131f8d2cb1195ada5e0e691b6868ebcd8a845. Given the critical nature of 5G core infrastructure, this vulnerability poses a significant risk to operational networks.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, indicating that a full vector has not been assigned by NVD. However, based on the technical details, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The attack is performed remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is affected.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Estimated Base Score: 7.5 (High)

Threat Level: High. The exploit is public, and the attack is trivial to execute against unpatched systems.

Deep Dive & Mechanics

The vulnerability is located in the Timer Handler component of Open5GS. The 5G core network relies heavily on timers for various procedures (e.g., session management, mobility management). The flaw involves a failure to properly validate or limit the number of timer events that can be processed.

Attack Mechanism:

1. An attacker sends a crafted sequence of network messages (e.g., malformed NAS messages, SBI requests) to a vulnerable Open5GS network function (e.g., AMF, SMF).
2. These messages cause the target function to create an excessive number of internal timers.
3. The Timer Handler component does not enforce a limit on the number of concurrent timers or the rate at which they are created.
4. This leads to resource exhaustion (CPU, memory, file descriptors), causing the network function to become unresponsive or crash.

Impact: A successful attack results in a denial of service for the affected 5G core function, potentially disrupting all connected User Equipment (UE) and services.

Vulnerable vs. Patched Code

The patch commit c7c131f8d2cb1195ada5e0e691b6868ebcd8a845 addresses the issue by introducing resource limits and validation checks in the timer handling logic.

Vulnerable Code (Conceptual):

// No limit on timer creation
void timer_handler_create_timer(event_t *event) {
    timer_t *timer = malloc(sizeof(timer_t));
    // ... initialize timer ...
    add_to_timer_list(timer);
}

Patched Code (Conceptual):

#define MAX_TIMERS 10000

void timer_handler_create_timer(event_t *event) {
    if (get_timer_count() >= MAX_TIMERS) {
        // Reject new timer creation
        ogs_error("Maximum timer limit reached");
        return;
    }
    timer_t *timer = malloc(sizeof(timer_t));
    // ... initialize timer ...
    add_to_timer_list(timer);
}

The patch adds a check to prevent the creation of timers beyond a defined maximum, thus preventing resource exhaustion.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running Open5GS version <= 2.7.5.
• Network access to the target's SBI (Service Based Interface) or N1/N2 interfaces.

Exploit Concept: The exploit involves sending a high volume of requests that trigger timer creation. For example, repeatedly initiating and immediately aborting PDU session establishment procedures.

Example Python Script (Conceptual):

import socket
import struct

def send_malformed_nas(target_ip, target_port):
    # Craft a malformed NAS message that triggers a timer
    # This is a simplified example; actual payloads require deep 5G NAS knowledge
    payload = b'\x00' * 100  # Placeholder for a malformed message
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.sendto(payload, (target_ip, target_port))
    sock.close()

def exploit(target_ip, target_port, num_requests=10000):
    for i in range(num_requests):
        send_malformed_nas(target_ip, target_port)
    print(f"Sent {num_requests} requests to {target_ip}:{target_port}")

# Usage
exploit("192.168.1.100", 38412, 50000)

Expected Outcome: The target Open5GS function becomes unresponsive, causing a denial of service.

Blue Team (Detection & Defense)

Detection:

• Monitor for a sudden spike in timer-related log entries.
• Track the number of active PDU sessions and NAS messages per source IP.
• Use the detection rules provided in the next section.

Defense:

• Apply the patch immediately.
• Implement network-level rate limiting on the SBI and N1/N2 interfaces.
• Deploy a Web Application Firewall (WAF) or API gateway to filter malformed requests.
• Enable resource monitoring and alerting for CPU/memory usage on 5GC nodes.

Indicators of Compromise (IOCs)

• Network IOCs:
  • High volume of NAS messages from a single source IP.
  • Malformed or incomplete PDU session establishment requests.
  • Repeated SBI requests with invalid parameters.
• System IOCs:
  • Excessive memory usage by the open5gs-amf, open5gs-smf, or other core processes.
  • High CPU utilization by the timer handler thread.
  • Log entries indicating "timer creation failed" or "resource exhaustion".
  • System logs showing out-of-memory (OOM) killer events.

Detection Engineering

YARA Rule

rule CVE_2025_15532_Open5GS_Timer_DoS {
    meta:
        description = "Detects potential exploitation of CVE-2025-15532 in Open5GS logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15532"
    strings:
        $timer_error = "timer creation failed" nocase
        $resource_exhaust = "resource exhaustion" nocase
        $oom = "Out of memory" nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-15532 - Open5GS Timer Handler DoS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects excessive timer creation events in Open5GS logs
author: Valters IT
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "timer creation failed"
        - "resource exhaustion"
        - "Out of memory"
    condition: selection
falsepositives:
    - Legitimate high load scenarios
level: high

Suricata Rule

alert udp any any -> $HOME_NET 38412 (msg:"CVE-2025-15532 - Open5GS NAS Timer DoS Attempt"; content:"|00 00 00 00|"; depth:4; threshold: type both, track by_src, count 1000, seconds 60; sid:1000001; rev:1;)

Note: The content match is a placeholder. A real rule would need to match specific malformed NAS message patterns.

Remediation & Mitigation

1. Immediate Action: Apply the patch from commit c7c131f8d2cb1195ada5e0e691b6868ebcd8a845 to all Open5GS instances.
2. Upgrade: Upgrade to the latest stable version of Open5GS that includes the fix.
3. Network Segmentation: Isolate the 5G core network functions behind firewalls and limit exposure to untrusted networks.
4. Rate Limiting: Implement rate limiting on the N1/N2 and SBI interfaces to prevent abuse.
5. Monitoring: Enable detailed logging and monitoring for timer-related events and resource usage.
6. Incident Response: If exploitation is suspected, isolate the affected network function, collect logs, and apply the patch before restoring service.

Valters IT