CVE-2025-63288

Executive Summary

CVE-2025-63288 describes a denial of service (DoS) vulnerability in Open5GS version 2.7.6. The Access and Mobility Management Function (AMF) component crashes when processing a malformed or abnormal NGSetupRequest message. This allows an unauthenticated attacker on the 5G core network to cause a service outage by sending a specially crafted NGAP message. The vulnerability has a CVSS score of 0.0 (placeholder), but based on the impact, it is likely a high-severity issue. No public exploit code or proof-of-concept is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder – actual score likely 7.5+ based on network-based DoS)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)
• Threat Level: High – unauthenticated remote DoS on a critical 5G core component.

Deep Dive & Mechanics

The vulnerability resides in the AMF's handling of the NGSetupRequest message, which is part of the NG Application Protocol (NGAP) used between the gNodeB and the AMF. When the AMF receives an NGSetupRequest with abnormal or unexpected fields (e.g., invalid PLMN, malformed TAI, or missing mandatory IEs), it fails to validate the input properly. This leads to a null pointer dereference or an unhandled exception, causing the AMF process to crash.

The crash results in a denial of service for all UEs attached to that AMF, as the AMF is no longer available to process mobility management, session management, or registration requests. The attack can be repeated, making the AMF persistently unavailable.

Vulnerable vs. Patched Code

Vulnerable Code (Open5GS 2.7.6): The AMF's NGAP message handler likely lacks proper input validation for the NGSetupRequest. For example, it may assume that certain Information Elements (IEs) are always present and valid.

// Simplified vulnerable pseudo-code
void handle_ng_setup_request(ngap_message_t *msg) {
    // No validation of msg->plmn or msg->tai
    amf_ctx_t *ctx = amf_ctx_new(msg->plmn, msg->tai);
    // If msg->plmn is NULL, ctx becomes NULL
    amf_ctx_process(ctx); // NULL pointer dereference
}

Patched Code (Hypothetical): The patched version would add input validation and null checks before processing.

// Patched pseudo-code
void handle_ng_setup_request(ngap_message_t *msg) {
    if (!msg || !msg->plmn || !msg->tai) {
        // Log error and send NGSetupFailure
        ngap_send_failure(msg->gnb_id, NGAP_Cause_Protocol);
        return;
    }
    amf_ctx_t *ctx = amf_ctx_new(msg->plmn, msg->tai);
    if (!ctx) {
        ngap_send_failure(msg->gnb_id, NGAP_Cause_Processing);
        return;
    }
    amf_ctx_process(ctx);
}

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a test 5G core with Open5GS 2.7.6. Use a tool like scapy or a custom NGAP fuzzer to craft a malformed NGSetupRequest.
2. Crafting the Payload: The payload should contain an invalid or missing mandatory IE, such as a NULL PLMN or an out-of-bounds TAI.
3. Execution: Send the crafted NGSetupRequest to the AMF's NGAP endpoint (usually port 38412/SCTP).

# Example using scapy (simplified)
from scapy.all import *
from scapy.contrib.nap import NGAP, NGSetupRequest

# Craft a malformed NGSetupRequest with missing PLMN
pkt = IP(dst="192.168.1.100")/SCTP(dport=38412)/NGAP()/NGSetupRequest(plmn=None)
send(pkt)

4. Impact: The AMF crashes, causing a DoS. Repeat to maintain the attack.

Blue Team

1. Detection: Monitor for abnormal NGAP messages. Use the Sigma rule below to detect malformed NGSetupRequest.
2. Mitigation: Implement input validation at the network edge. Use a WAF or IDS to filter malformed NGAP messages.
3. Response: If an AMF crash is detected, restart the AMF service and block the source IP.

Indicators of Compromise (IOCs)

• Network: SCTP packets to port 38412 with malformed NGAP IEs (e.g., missing PLMN, invalid TAI).
• Logs: AMF logs showing "NULL pointer dereference" or "Segmentation fault" in the NGAP handler.
• System: AMF process crash (core dump) in /var/log/open5gs/amf.log.

Detection Engineering

YARA Rule

rule CVE_2025_63288_AMF_DoS {
    meta:
        description = "Detects malformed NGSetupRequest targeting Open5GS AMF"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-63288"
    strings:
        $ngap_header = { 00 15 00 ?? 00 00 } // NGAP PDU with ProcedureCode=0 (NGSetup)
        $missing_ie = { 00 00 } // Placeholder for missing mandatory IE
    condition:
        $ngap_header and #missing_ie > 0
}

Sigma Rule

title: Detection of Malformed NGSetupRequest
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects abnormal NGSetupRequest messages that may cause AMF crash
author: Valters IT
logsource:
    category: network
    product: suricata
detection:
    selection:
        app_proto: 'ngap'
        ngap.procedureCode: 0
        ngap.criticality: 'reject'
    condition: selection
falsepositives:
    - Legitimate NGSetupRequest with rare but valid IEs
level: high

Suricata Rule

alert sctp any any -> any 38412 (msg:"CVE-2025-63288 - Malformed NGSetupRequest"; flow:to_server; content:"|00 15|"; offset:0; depth:2; content:"|00 00|"; within:4; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Apply the official patch from Open5GS when available. Monitor the Open5GS GitHub repository for updates.
2. Workaround: If patching is not possible, implement network-level filtering to drop malformed NGAP messages. Use a firewall or IDS to block SCTP packets with invalid IEs.
3. Configuration: Enable AMF logging and monitoring to detect crashes early.
4. Architecture: Deploy redundant AMF instances to ensure high availability.

Valters IT
DevSecOps & Cyber Threat Intelligence