CVE-2021-45462
📋 TL;DR
CVE-2021-45462 is a denial-of-service vulnerability in Open5GS 2.4.0 where a malicious User Equipment (UE) can send a specially crafted packet to crash the SGW-U/UPF components. This affects 5G core network deployments using vulnerable Open5GS versions, potentially disrupting mobile data services.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of 5G data services in affected network segments, leading to widespread connectivity loss for mobile users.
Likely Case
Intermittent service outages affecting specific network nodes, requiring manual restart of crashed components.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing rapid detection and recovery.
🎯 Exploit Status
Exploitation requires UE access but the crash mechanism is straightforward once packet crafting is understood. No authentication bypass needed beyond normal UE access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit a0f2535cb5a29bba6dbbccdb90c74ccd770cc700 and later versions
Vendor Advisory: https://github.com/open5gs/open5gs/commit/a0f2535cb5a29bba6dbbccdb90c74ccd770cc700
Restart Required: Yes
Instructions:
1. Update Open5GS to version after commit a0f2535cb5a29bba6dbbccdb90c74ccd770cc700. 2. Restart SGW-U/UPF components. 3. Verify no crashes occur during normal operation.
🔧 Temporary Workarounds
Network segmentation
allIsolate SGW-U/UPF components from untrusted UE traffic using firewalls or network policies
Rate limiting
linuxImplement packet rate limiting on UE-facing interfaces to reduce attack surface
iptables -A INPUT -p udp --dport 2152 -m limit --limit 1000/min -j ACCEPT
iptables -A INPUT -p udp --dport 2152 -j DROP
🧯 If You Can't Patch
- Implement strict UE authentication and monitoring to detect anomalous packet patterns
- Deploy redundant SGW-U/UPF instances with automatic failover to maintain service during crashes
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: if running 2.4.0 without the fix commit, system is vulnerableCheck Version:
open5gs --version 2>&1 | grep -i versionVerify Fix Applied:
Verify Open5GS version includes commit a0f2535cb5a29bba6dbbccdb90c74ccd770cc700 and monitor SGW-U/UPF processes for stability📡 Detection & Monitoring
Log Indicators:
- SGW-U/UPF process crashes in system logs
- Abnormal termination messages in Open5GS logs
- Sudden service interruption alerts
Network Indicators:
- Unusual packet patterns from UE devices
- Spike in malformed GTP-U packets
- Service disruption reports from monitoring systems
SIEM Query:
source="open5gs.log" AND ("crash" OR "segmentation fault" OR "abnormal termination") AND process="sgwu" OR process="upf"🔗 References
- https://github.com/open5gs/open5gs/commit/a0f2535cb5a29bba6dbbccdb90c74ccd770cc700
- https://www.trendmicro.com/en_us/research/23/i/attacks-on-5g-infrastructure-from-users-devices.html
- https://github.com/open5gs/open5gs/commit/a0f2535cb5a29bba6dbbccdb90c74ccd770cc700
- https://www.trendmicro.com/en_us/research/23/i/attacks-on-5g-infrastructure-from-users-devices.html
