CVE-2025-15555

Executive Summary

CVE-2025-15555 is a critical stack-based buffer overflow vulnerability in Open5GS, an open-source implementation of 5G Core and EPC (Evolved Packet Core) network functions. The flaw resides in the hss_ogs_diam_cx_mar_cb function within the src/hss/hss-cx-path.c file, specifically in the VoLTE Cx-Test component. By manipulating the OGS_KEY_LEN argument, an attacker can trigger a stack-based buffer overflow, potentially leading to remote code execution (RCE) or denial of service (DoS). The vulnerability affects Open5GS versions up to 2.7.6. A patch is available via commit 54dda041211098730221d0ae20a2f9f9173e7a21. No public proof-of-concept (PoC) or exploit code has been identified at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a source-code level flaw in the Open5GS C project, which is typically compiled and deployed as a network function in 5G core infrastructure.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that a full vector has not been officially assigned. However, based on the nature of the vulnerability (stack-based buffer overflow, remotely exploitable), a reasonable estimated CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Potential for memory disclosure.
• Integrity (I): High (H) – Potential for code injection.
• Availability (A): High (H) – Potential for crash or DoS.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow in the Home Subscriber Server (HSS) component of Open5GS. The HSS is a critical database that stores subscriber information and authentication vectors for VoLTE (Voice over LTE) services. The vulnerable function hss_ogs_diam_cx_mar_cb handles Multimedia Authentication Requests (MAR) in the Cx interface (Diameter protocol).

Root Cause: The function uses a fixed-size stack buffer to store a key derived from the OGS_KEY_LEN argument. If the attacker provides a value for OGS_KEY_LEN that exceeds the buffer size, the memcpy or similar operation will overflow the stack, corrupting adjacent memory (return addresses, local variables, etc.).

Attack Vector: An attacker can send a crafted Diameter MAR message to the HSS with an oversized OGS_KEY_LEN attribute. This can be done remotely without authentication, as the Cx interface is typically exposed to the network.

Impact: Successful exploitation could allow an attacker to:

• Execute arbitrary code in the context of the HSS process.
• Crash the HSS service (DoS).
• Leak sensitive memory contents (e.g., subscriber keys, authentication vectors).
• Potentially pivot to other network functions within the 5G core.

Vulnerable vs. Patched Code

Vulnerable Code (before patch):

// src/hss/hss-cx-path.c (simplified)
void hss_ogs_diam_cx_mar_cb(struct msg **msg) {
    char key_buffer[OGS_KEY_LEN_MAX]; // Fixed-size buffer
    // ...
    // Attacker-controlled OGS_KEY_LEN is used without bounds check
    memcpy(key_buffer, msg_data, OGS_KEY_LEN); // Overflow!
    // ...
}

Patched Code (after commit 54dda041211098730221d0ae20a2f9f9173e7a21):

// src/hss/hss-cx-path.c (simplified)
void hss_ogs_diam_cx_mar_cb(struct msg **msg) {
    char key_buffer[OGS_KEY_LEN_MAX]; // Fixed-size buffer
    // ...
    // Bounds check added
    if (OGS_KEY_LEN > OGS_KEY_LEN_MAX) {
        ogs_error("Invalid key length: %d", OGS_KEY_LEN);
        return; // Reject the message
    }
    memcpy(key_buffer, msg_data, OGS_KEY_LEN); // Safe now
    // ...
}

The patch adds a validation check to ensure OGS_KEY_LEN does not exceed the maximum allowed size (OGS_KEY_LEN_MAX), preventing the overflow.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A vulnerable Open5GS instance (version <= 2.7.6) with HSS component exposed.
• Network access to the Cx interface (typically port 3868 for Diameter).
• A tool to craft and send Diameter messages (e.g., diameter-client, scapy, or custom Python script).

Exploitation Steps:

1. Identify Target: Scan for Open5GS HSS services on port 3868.
2. Craft Malicious MAR Message: Create a Diameter MAR message with an oversized OGS_KEY_LEN AVP (Attribute-Value Pair). The AVP code for OGS_KEY_LEN is vendor-specific (likely 3GPP defined).
3. Send Message: Transmit the crafted message to the HSS.
4. Trigger Overflow: The HSS processes the message, causing a stack buffer overflow.
5. Achieve RCE (if applicable): Overwrite the return address with a controlled value to redirect execution to shellcode.

Example Python snippet (conceptual):

import socket

def craft_malicious_mar():
    # Construct a Diameter MAR message with oversized OGS_KEY_LEN
    # This is a simplified example; real implementation requires proper Diameter encoding
    avp_ogs_key_len = b'\x00\x00\x01\x2a'  # AVP code for OGS_KEY_LEN (hypothetical)
    avp_length = b'\x00\x00\x04\x00'  # Length = 1024 bytes (overflow)
    avp_data = b'A' * 1024  # Overflow payload
    mar_message = b''  # Full Diameter message construction omitted for brevity
    return mar_message

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(('target_ip', 3868))
sock.send(craft_malicious_mar())
sock.close()

Blue Team (Defense & Detection)

Defense Measures:

1. Patch Immediately: Apply the patch from commit 54dda041211098730221d0ae20a2f9f9173e7a21 or upgrade to a fixed version.
2. Network Segmentation: Restrict access to the Cx interface (port 3868) to trusted network segments only.
3. Input Validation: Implement strict validation of all Diameter AVP lengths at the network edge (e.g., using a Diameter firewall).
4. Stack Canaries: Compile Open5GS with stack protection flags (e.g., -fstack-protector-strong).
5. ASLR & NX: Ensure Address Space Layout Randomization (ASLR) and Non-Executable (NX) stack are enabled on the host.

Detection Steps:

1. Monitor for oversized Diameter messages on port 3868.
2. Look for crashes or abnormal terminations of the HSS process.
3. Analyze logs for errors related to OGS_KEY_LEN or buffer overflow.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Diameter MAR messages with OGS_KEY_LEN AVP exceeding 256 bytes (typical max).
  • Unusual traffic on port 3868 from untrusted IPs.
• Host IOCs:
  • HSS process crash logs with segmentation faults.
  • Core dumps in /var/crash/ or similar.
  • Unexpected memory regions in process memory (e.g., 0x41414141 patterns).
• File IOCs:
  • Modified hss-cx-path.c file (if attacker replaced binary).
  • Suspicious shared libraries loaded by the HSS process.

Detection Engineering

YARA Rule

rule CVE_2025_15555_Open5GS_HSS_Overflow {
    meta:
        description = "Detects potential exploitation of CVE-2025-15555 in Open5GS HSS"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15555"
    strings:
        $overflow_pattern = { 00 00 01 2A [0-4] 00 00 04 00 }  // AVP code and oversized length
        $hss_path = "hss-cx-path.c"
        $ogs_key_len = "OGS_KEY_LEN"
    condition:
        $overflow_pattern or ($hss_path and $ogs_key_len)
}

Sigma Rule

title: CVE-2025-15555 Open5GS HSS Buffer Overflow Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects oversized Diameter MAR messages targeting Open5GS HSS
author: Valters IT
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 3868
        app_protocol: diameter
        diameter.cmd_code: 303  # MAR command code
        diameter.avp_code: 298  # OGS_KEY_LEN AVP code (hypothetical)
        diameter.avp_length: "> 256"
    condition: selection
falsepositives:
    - Legitimate large key lengths (unlikely)
level: high

Suricata Rule

alert tcp any any -> any 3868 (msg:"CVE-2025-15555 Open5GS HSS Buffer Overflow Attempt"; flow:to_server; content:"|00 00 01 2A|"; depth:4; content:"|00 00 04 00|"; distance:0; within:4; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the Patch: Update Open5GS to a version that includes commit 54dda041211098730221d0ae20a2f9f9173e7a21 or later.
2. Restrict Network Access: Use firewall rules to limit access to the HSS Cx interface (port 3868) to only trusted IPs (e.g., other core network functions).
3. Enable Stack Protection: Recompile Open5GS with -fstack-protector-strong and -D_FORTIFY_SOURCE=2.

Long-Term Mitigations:

1. Code Audit: Conduct a thorough security review of all Diameter message handling code in Open5GS.
2. Fuzzing: Implement continuous fuzzing of the HSS component to discover similar vulnerabilities.
3. Network Monitoring: Deploy IDS/IPS rules (like the Suricata rule above) to detect exploitation attempts.
4. Least Privilege: Run the HSS process with minimal necessary privileges (e.g., not as root).

Workaround (if patching is not immediately possible):

• Disable the VoLTE Cx-Test functionality if not required.
• Use a Web Application Firewall (WAF) or Diameter firewall to inspect and block oversized AVPs.

Valters IT