CVE-2025-15539

Executive Summary

CVE-2025-15539 is a denial-of-service (DoS) vulnerability in Open5GS, an open-source implementation of the 5G Core and Evolved Packet Core (EPC). The vulnerability resides in the sgwc component, specifically within the function sgwc_s11_handle_downlink_data_notification_ack in the file src/sgwc/s11-handler.c. An unauthenticated remote attacker can trigger a NULL pointer dereference, causing the sgwc process to crash and leading to a denial of service for the Serving Gateway Control Plane (SGW-C) functionality. The exploit has been publicly disclosed, and a patch is available in the Open5GS repository. The CVSS score is 0.0 due to incomplete NVD data, but based on the technical details, a more accurate score is 7.5 (High) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Supply Chain & Package Security

Open5GS is a critical component in 5G network infrastructure, often deployed in research, testing, and production environments. The vulnerability affects the sgwc component, which is part of the core network. Organizations using Open5GS in their supply chain should immediately verify their version and apply the patch. The package is typically distributed via GitHub releases, Docker images, or built from source. Ensure that the source code or container images are updated to a version that includes the fix.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack can be initiated remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attack is straightforward.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The service is completely disrupted.

CVSS Score: 7.5 (High)

Threat Level: High. The exploit is publicly available, and the attack can be performed remotely without authentication. The impact is a denial of service on the SGW-C, which can disrupt 5G/EPC data plane operations.

Deep Dive & Mechanics

The vulnerability is a NULL pointer dereference in the sgwc_s11_handle_downlink_data_notification_ack function. This function processes S11 Downlink Data Notification Acknowledgment messages from the MME (Mobility Management Entity) or SGSN (Serving GPRS Support Node). The issue occurs when the function attempts to access a pointer that has not been properly initialized or validated.

Root Cause: In the vulnerable code, the function receives a message and attempts to retrieve a session context. If the session context is not found (e.g., due to a malformed or unexpected message), the function proceeds to use a NULL pointer without checking, leading to a crash.

Attack Vector: An attacker can send a crafted S11 Downlink Data Notification Acknowledgment message to the SGW-C. The message can be sent from a compromised MME/SGSN or directly if the attacker has network access to the S11 interface. The S11 interface is typically internal to the operator's network, but if exposed or if an attacker gains access to the core network, the attack can be executed.

Impact: The sgwc process crashes, causing the SGW-C to become unavailable. This disrupts the control plane for the Serving Gateway, potentially affecting all sessions managed by that SGW-C. The data plane may continue to operate for existing sessions, but new sessions cannot be established, and existing sessions may eventually time out.

Vulnerable vs. Patched Code

Vulnerable Code (Open5GS <= 2.7.6):

// src/sgwc/s11-handler.c
void sgwc_s11_handle_downlink_data_notification_ack(
        sgwc_sess_t *sess, ogs_sbi_message_t *recvmsg)
{
    // ... other code ...
    sgwc_bearer_t *bearer = sgwc_bearer_find_by_sess(sess);
    // bearer could be NULL if sess is invalid or not found
    // No NULL check before dereference
    sgwc_ue_t *ue = bearer->ue;  // NULL pointer dereference if bearer is NULL
    // ... rest of function ...
}

Patched Code (after commit b4707272c1caf6a7d4dca905694ea55557a0545f):

// src/sgwc/s11-handler.c
void sgwc_s11_handle_downlink_data_notification_ack(
        sgwc_sess_t *sess, ogs_sbi_message_t *recvmsg)
{
    // ... other code ...
    sgwc_bearer_t *bearer = sgwc_bearer_find_by_sess(sess);
    if (!bearer) {
        ogs_error("No bearer found for session");
        return;  // Graceful exit instead of crash
    }
    sgwc_ue_t *ue = bearer->ue;
    // ... rest of function ...
}

The patch adds a NULL check for the bearer pointer before dereferencing it. If the bearer is not found, the function logs an error and returns gracefully, preventing the crash.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Network access to the S11 interface of the Open5GS SGW-C.
• Ability to craft and send S11 messages (e.g., using a tool like scapy or a custom script).

Exploit Steps:

1. Identify Target: Scan for Open5GS SGW-C instances. The S11 interface typically listens on port 38412 (SCTP) or 2123 (GTPv1-C). Use Shodan or Nmap to find targets.

2. Craft Malicious Message: Create a Downlink Data Notification Acknowledgment message with an invalid or missing session context. The exact payload can be derived from the Open5GS source code and the S11 protocol specification (3GPP TS 29.274).

3. Send Message: Send the crafted message to the target SGW-C. This can be done using a raw socket or a tool like sctp_echo or a custom Python script.

Example Python Script (Conceptual):

import socket
import struct

# S11 Downlink Data Notification Acknowledgment message
# This is a simplified example; actual message requires proper GTPv2-C headers
def craft_malicious_message():
    # GTPv2-C header
    version = 2
    piggyback = 0
    teid = 0  # Invalid TEID to trigger NULL pointer
    message_type = 0x4A  # Downlink Data Notification Acknowledgment
    # ... build rest of message ...
    return payload

def exploit(target_ip, target_port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    payload = craft_malicious_message()
    sock.send(payload)
    sock.close()

if __name__ == "__main__":
    exploit("192.168.1.100", 2123)

Expected Outcome: The SGW-C process crashes, causing a denial of service.

Blue Team

Detection:

• Monitor for S11 Downlink Data Notification Acknowledgment messages with invalid or unexpected session contexts.
• Look for crashes in the sgwc process logs (e.g., segmentation faults, NULL pointer dereferences).
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Mitigation:

• Apply the patch immediately.
• Restrict network access to the S11 interface to trusted MME/SGSN nodes only.
• Implement network segmentation to prevent attackers from reaching the core network.
• Use an intrusion detection system (IDS) to detect malicious S11 messages.

Indicators of Compromise (IOCs)

• Network IOCs:
  • S11 Downlink Data Notification Acknowledgment messages with invalid TEID (Tunnel Endpoint Identifier) or missing Information Elements.
  • Unexpected SCTP or GTPv2-C traffic on port 38412 or 2123 from untrusted sources.
• System IOCs:
  • Crash logs from sgwc containing messages like "Segmentation fault" or "NULL pointer dereference".
  • Core dump files generated by the sgwc process.
• File IOCs:
  • Log entries in /var/log/open5gs/sgwc.log indicating errors before the crash.

Detection Engineering

YARA Rule

rule CVE_2025_15539_Open5GS_SGWC_DoS {
    meta:
        description = "Detects exploit attempts for CVE-2025-15539 targeting Open5GS SGW-C"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-15539"
    strings:
        $s11_ddn_ack = { 4A }  // GTPv2-C message type for Downlink Data Notification Acknowledgment
        $null_teid = { 00 00 00 00 }  // TEID set to zero (invalid)
    condition:
        $s11_ddn_ack and $null_teid
}

Sigma Rule

title: CVE-2025-15539 Open5GS SGW-C DoS Exploit
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network traffic attempting to exploit CVE-2025-15539
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        app_proto: 'gtpv2'
        gtpv2.message_type: '0x4A'
        gtpv2.teid: '0x00000000'
    condition: selection
falsepositives:
    - Legitimate testing with invalid TEID
level: high

Suricata Rule

alert gtpv2 any any -> any any (msg:"CVE-2025-15539 Open5GS SGW-C DoS Exploit"; gtpv2.message_type:0x4A; gtpv2.teid:0x00000000; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the Patch: Update Open5GS to a version that includes commit b4707272c1caf6a7d4dca905694ea55557a0545f. This can be done by pulling the latest source code from the repository and rebuilding, or by applying the patch manually.
2. Restrict Network Access: Ensure that the S11 interface is only accessible from trusted MME/SGSN nodes. Use firewalls or network ACLs to block unauthorized access.
3. Monitor Logs: Enable detailed logging for the sgwc component and monitor for any signs of exploitation.

Long-Term Mitigations:

• Code Review: Conduct a thorough code review of the sgwc component and other S11 handlers for similar NULL pointer dereference issues.
• Fuzzing: Implement fuzz testing for the S11 interface to identify other potential vulnerabilities.
• Network Segmentation: Place the core network components in a separate, highly restricted network segment.
• IDS/IPS: Deploy intrusion detection/prevention systems with rules to detect malicious S11 messages.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Expert System.