CVE-2025-65566
📋 TL;DR
A denial-of-service vulnerability in the omec-project UPF's pfcpiface component allows attackers to crash the UPF process by sending malformed PFCP Session Report Response messages missing the mandatory Cause Information Element. This disrupts user-plane services in 5G networks. Organizations running the vulnerable UPF version are affected.
💻 Affected Systems
- omec-project UPF (pfcpiface component)
📦 What is this software?
Upf by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of user-plane services in affected 5G network segments, causing service outages for all connected users.
Likely Case
Intermittent UPF crashes leading to service degradation and potential network instability.
If Mitigated
Limited impact with proper network segmentation and monitoring allowing quick detection and recovery.
🎯 Exploit Status
Exploitation requires sending specially crafted PFCP messages to the N4 interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check GitHub issue for latest patched version
Vendor Advisory: https://github.com/omec-project/upf/issues/958
Restart Required: Yes
Instructions:
1. Monitor GitHub issue #958 for patch release. 2. Update to patched version. 3. Restart UPF services. 4. Verify fix with test PFCP messages.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to UPF N4/PFCP endpoint to trusted sources only.
iptables -A INPUT -p tcp --dport <pfcp-port> -s <trusted-ips> -j ACCEPT
iptables -A INPUT -p tcp --dport <pfcp-port> -j DROP
🧯 If You Can't Patch
- Implement strict network ACLs to limit PFCP traffic to authorized SMF nodes only.
- Deploy monitoring to detect UPF process crashes and implement automated restart mechanisms.
🔍 How to Verify
Check if Vulnerable:
Check UPF version: docker images | grep upf-epc-pfcpiface or check deployment manifests for version 2.1.3-dev.Check Version:
docker inspect <upf-container> | grep -i versionVerify Fix Applied:
After patching, test with malformed PFCP Session Report Response messages and verify UPF doesn't crash.📡 Detection & Monitoring
Log Indicators:
- UPF process panic messages
- nil pointer dereference errors in logs
- UPF service restart events
Network Indicators:
- Unusual PFCP traffic patterns
- Multiple malformed PFCP Session Report Response messages
SIEM Query:
source="upf.log" AND ("panic" OR "nil pointer" OR "session report handler")