CVE-2025-44951
📋 TL;DR
A buffer overflow vulnerability in the PFCP library of open5gs allows a local attacker to execute arbitrary code or cause denial of service by providing overly long device identifiers. This affects both SMF and UPF components in open5gs versions 2.7.2 and earlier.
💻 Affected Systems
- open5gs
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise via arbitrary code execution.
Likely Case
Denial of service causing SMF/UPF service crashes and network disruption.
If Mitigated
Service disruption limited to affected components with no lateral movement.
🎯 Exploit Status
Exploitation requires local access to the system but the vulnerability is straightforward to trigger.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit e3dd98cd291fba233a46adb2881213fc6e38b924
Vendor Advisory: https://github.com/open5gs/open5gs/issues/3775
Restart Required: Yes
Instructions:
1. Update open5gs to latest version or apply commit e3dd98cd291fba233a46adb2881213fc6e38b924
2. Restart both SMF and UPF services
3. Verify the fix by checking the session.dev field length validation
🔧 Temporary Workarounds
Input validation via wrapper
linuxImplement wrapper function to validate session.dev field length before passing to ogs_pfcp_dev_add
Implement custom validation: if(strlen(session.dev) > 32) { return ERROR; }
🧯 If You Can't Patch
- Restrict local access to open5gs systems using strict user permissions and access controls.
- Monitor for abnormal process crashes or memory usage in SMF/UPF components.
🔍 How to Verify
Check if Vulnerable:
Check open5gs version: open5gs --version and verify if it's 2.7.2 or earlier.Check Version:
open5gs --versionVerify Fix Applied:
Verify the commit e3dd98cd291fba233a46adb2881213fc6e38b924 is present in your installation.📡 Detection & Monitoring
Log Indicators:
- SMF/UPF process crashes
- Memory access violation errors in system logs
- Abnormal termination of ogs-pfcp processes
Network Indicators:
- PFCP session establishment failures
- Unusual PFCP message sizes exceeding normal bounds
SIEM Query:
process_name:ogs* AND (event_type:crash OR error_message:"buffer overflow" OR error_message:"segmentation fault")