CVE-2025-8803
📋 TL;DR
This vulnerability in Open5GS AMF component allows remote attackers to cause denial of service by exploiting a flaw in the gmm_state_de_registered/gmm_state_exception functions. Systems running Open5GS up to version 2.7.5 are affected, particularly those with AMF services exposed to untrusted networks.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete AMF service disruption leading to 5G network authentication and mobility management failures for all connected devices
Likely Case
Temporary AMF service degradation affecting new device registrations and mobility procedures
If Mitigated
Minimal impact with proper network segmentation and rate limiting in place
🎯 Exploit Status
Requires specific malformed messages to trigger the vulnerable state transition
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.6
Vendor Advisory: https://github.com/open5gs/open5gs/releases/tag/v2.7.6
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Stop Open5GS services. 3. Upgrade to version 2.7.6 via package manager or source compilation. 4. Apply patch 1f30edac27f69f61cff50162e980fe58fdeb30ca if compiling from source. 5. Restart Open5GS services.
🔧 Temporary Workarounds
Network Segmentation
LinuxRestrict AMF service access to trusted networks only
iptables -A INPUT -p tcp --dport 38412 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 38412 -j DROP
Rate Limiting
LinuxLimit connection attempts to AMF service
iptables -A INPUT -p tcp --dport 38412 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 38412 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit AMF exposure
- Deploy intrusion detection/prevention systems to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-amfd --version | grep '2.7'Check Version:
open5gs-amfd --versionVerify Fix Applied:
Verify version is 2.7.6 or higher: open5gs-amfd --version📡 Detection & Monitoring
Log Indicators:
- AMF service crashes
- Unusual state transition errors in gmm-sm.c logs
- Multiple failed authentication attempts from single source
Network Indicators:
- Abnormal AMF protocol messages
- High volume of malformed 5G NAS messages
SIEM Query:
source="open5gs.log" AND ("gmm_state_de_registered" OR "gmm_state_exception") AND error🔗 References
- https://github.com/ZHENGHAOHELLO/BugReport
- https://github.com/open5gs/open5gs/commit/1f30edac27f69f61cff50162e980fe58fdeb30ca
- https://github.com/open5gs/open5gs/issues/3948
- https://github.com/open5gs/open5gs/issues/3948#issuecomment-3030223641
- https://github.com/open5gs/open5gs/releases/tag/v2.7.6
- https://vuldb.com/?ctiid.319332
- https://vuldb.com/?id.319332
- https://vuldb.com/?submit.626123
- https://github.com/open5gs/open5gs/issues/3948
