CVE-2025-9405

Executive Summary

CVE-2025-9405 is a reachable assertion vulnerability in Open5GS, a 5G Core network implementation, affecting versions up to and including 2.7.5. The flaw resides in the gmm_state_exception function within src/amf/gmm-sm.c. An unauthenticated remote attacker can trigger a denial of service (DoS) by sending a specially crafted NAS message that causes the AMF (Access and Mobility Management Function) to hit an assertion, crashing the process. The exploit has been publicly released, and a patch is available in commit 8e5fed16114f2f5e40bee1b161914b592b2b7b8f. This vulnerability poses a significant risk to 5G core deployments, potentially disrupting mobile network services.

Supply Chain & Package Security

Open5GS is a widely used open-source 5G core network software, often deployed in research, testing, and production environments. The vulnerability is in the core AMF component, which is critical for network access and mobility management. Organizations using Open5GS in their infrastructure should treat this as a high-priority supply chain security issue, as a successful exploit can lead to service outages.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The attack is remotely exploitable.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The exploit affects only the vulnerable component.
• Confidentiality (C): None (N) – No data breach.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete denial of service.

Estimated CVSS Score: 7.5 (High)

Threat Level: High. The availability impact is severe, and the exploit is public.

Deep Dive & Mechanics

The vulnerability is a classic reachable assertion flaw. The gmm_state_exception function in src/amf/gmm-sm.c is part of the GPRS Mobility Management (GMM) state machine. This function is invoked when the AMF receives a NAS (Non-Access Stratum) message that does not match the expected state of the UE (User Equipment) context.

The issue occurs because the function contains an assert() call that can be triggered by a malformed or unexpected NAS message. In debug builds, assert() terminates the process. In release builds, if NDEBUG is not defined, the same behavior occurs. The attacker can send a crafted NAS message that forces the AMF into an invalid state, causing the assertion to fail and the AMF process to crash.

The root cause is insufficient input validation and state management. The AMF should gracefully handle unexpected messages by logging an error and discarding the message, rather than crashing.

Vulnerable vs. Patched Code

Vulnerable Code (Open5GS <= 2.7.5):

// src/amf/gmm-sm.c
void gmm_state_exception(amf_ue_t *amf_ue, ogs_nas_message_t *message) {
    // ... some code ...
    assert(0); // Reachable assertion
    // ... more code ...
}

Patched Code (after commit 8e5fed16114f2f5e40bee1b161914b592b2b7b8f):

// src/amf/gmm-sm.c
void gmm_state_exception(amf_ue_t *amf_ue, ogs_nas_message_t *message) {
    // ... some code ...
    ogs_warn("GMM state exception for UE [%s]", amf_ue->supi);
    // Instead of assert(0), log and return
    return;
    // ... more code ...
}

The patch replaces the assert(0) with a warning log and a graceful return, preventing the crash.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running Open5GS <= 2.7.5 with the AMF component exposed.
• Network access to the AMF's N1/N2 interface (typically port 38412 or 38472 for SCTP, or 80/443 for HTTP/2).

Exploit Steps:

1. Craft a malicious NAS message: The attacker needs to send a NAS message that causes the AMF to enter the gmm_state_exception state. This can be achieved by sending a message with an invalid message type or sequence number that does not match the UE's current state.

2. Send the message: Use a tool like scapy or a custom script to send the crafted NAS message over SCTP or HTTP/2 to the AMF.

3. Observe the crash: The AMF process will crash due to the assertion failure, causing a denial of service.

Example Python script using scapy (conceptual):

#!/usr/bin/env python3
from scapy.all import *
import socket

# Target AMF IP and port
target_ip = "192.168.1.100"
target_port = 38412  # SCTP port for N1/N2

# Craft a malformed NAS message (simplified)
# This is a placeholder; actual payload requires deep knowledge of NAS protocol
nas_payload = b"\x00\x01\x02\x03"  # Invalid NAS message

# Send over SCTP (requires kernel support or using raw sockets)
# For HTTP/2, use appropriate libraries
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))
sock.send(nas_payload)
sock.close()

Note: A full exploit script is not provided due to the complexity of NAS protocol and the need for precise message crafting. The public exploit release contains the necessary details.

Blue Team

Detection and Response:

1. Monitor AMF logs: Look for repeated "GMM state exception" warnings (if patched) or sudden crashes.
2. Network monitoring: Detect anomalous NAS messages targeting the AMF.
3. Process monitoring: Alert on AMF process crashes or restarts.
4. Rate limiting: Implement rate limiting on NAS messages to mitigate DoS attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual NAS messages with invalid message types or sequence numbers.
  • SCTP or HTTP/2 traffic to the AMF from unexpected sources.
  • Repeated connection attempts to the AMF's N1/N2 interface.

• System IOCs:

  • AMF process crash logs (e.g., assertion failed in syslog).
  • Core dumps from the AMF process.
  • Sudden restart of the AMF service.

• File IOCs:

  • Presence of exploit scripts or tools on the network.

Detection Engineering

YARA Rule

rule CVE_2025_9405_Open5GS_AMF_Assertion {
    meta:
        description = "Detects exploit attempts for CVE-2025-9405 in Open5GS AMF"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-9405"
    strings:
        $assert = "assert(0)" nocase
        $gmm_state = "gmm_state_exception" nocase
    condition:
        $assert and $gmm_state
}

Sigma Rule

title: Open5GS AMF Assertion Failure
id: 8e5fed16-114f-2f5e-40be-e1b161914b59
status: experimental
description: Detects assertion failures in Open5GS AMF logs indicating CVE-2025-9405 exploitation
author: Valters IT
date: 2025-04-10
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "assertion failed"
        - "gmm_state_exception"
    condition: selection
falsepositives:
    - Debug builds with intentional assertions
level: high

Suricata Rule

alert tcp any any -> $AMF_IP 38412 (msg:"CVE-2025-9405 Open5GS AMF Assertion Exploit"; flow:to_server; content:"|00 01 02 03|"; depth:4; classtype:attempted-dos; sid:1000001; rev:1;)

Note: The Suricata rule above uses a placeholder payload. A real rule would require analysis of the specific NAS message pattern that triggers the vulnerability.

Remediation & Mitigation

Immediate Actions:

1. Apply the patch: Update Open5GS to a version that includes commit 8e5fed16114f2f5e40bee1b161914b592b2b7b8f or later.
2. Restrict network access: Limit access to the AMF's N1/N2 interface to trusted networks only.
3. Enable logging: Ensure detailed logging is enabled for the AMF to detect exploitation attempts.

Long-term Measures:

1. Implement input validation: Ensure all NAS messages are validated before processing.
2. Use a WAF/IPS: Deploy a web application firewall or intrusion prevention system to filter malicious traffic.
3. Regular updates: Keep Open5GS and all dependencies up to date.
4. Security testing: Conduct regular penetration testing and code reviews.

Workaround (if patching is not immediately possible):

• Run the AMF in a container with resource limits to minimize the impact of a crash.
• Use a load balancer to failover to a healthy AMF instance.

Valters IT
Securing Digital Frontiers