CVE-2025-8805
📋 TL;DR
A denial-of-service vulnerability exists in Open5GS SMF component where the smf_gsm_state_wait_pfcp_deletion function can be manipulated remotely to crash the service. This affects Open5GS deployments up to version 2.7.5, potentially disrupting 5G core network functionality for service providers and enterprises.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete SMF service outage leading to disruption of 5G session management, preventing new connections and potentially affecting existing sessions.
Likely Case
Service disruption requiring manual restart of SMF component, causing temporary service degradation.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and recovery.
🎯 Exploit Status
Exploit details have been publicly disclosed in GitHub issues and requires understanding of PFCP protocol and SMF state machine.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.6
Vendor Advisory: https://github.com/open5gs/open5gs/releases/tag/v2.7.6
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Stop Open5GS services. 3. Upgrade to Open5GS 2.7.6 using package manager or source compilation. 4. Apply patch c58b8f081986aaf2a312d73a0a17985518b47fe6 if upgrading from source. 5. Restart Open5GS services.
🔧 Temporary Workarounds
Network Segmentation
LinuxRestrict network access to SMF component to only trusted NFs and management interfaces.
iptables -A INPUT -p tcp --dport <SMF_PORT> -s <TRUSTED_IP> -j ACCEPT
iptables -A INPUT -p tcp --dport <SMF_PORT> -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit SMF exposure
- Deploy monitoring and alerting for SMF service crashes with automated restart procedures
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs --version or examine installed package version. If version is 2.7.5 or earlier, system is vulnerable.Check Version:
open5gs --version || dpkg -l | grep open5gs || rpm -qa | grep open5gsVerify Fix Applied:
After upgrade, verify version is 2.7.6 or later and check that commit c58b8f081986aaf2a312d73a0a17985518b47fe6 is present in git log.📡 Detection & Monitoring
Log Indicators:
- SMF service crashes
- Unexpected termination of smf process
- Error messages related to smf_gsm_state_wait_pfcp_deletion
Network Indicators:
- Unusual PFCP traffic patterns to SMF
- Multiple connection attempts to SMF port
SIEM Query:
process:name="open5gs-smf" AND (event:type="crash" OR event:type="termination")🔗 References
- https://github.com/ZHENGHAOHELLO/BugReport
- https://github.com/open5gs/open5gs/commit/c58b8f081986aaf2a312d73a0a17985518b47fe6
- https://github.com/open5gs/open5gs/issues/4000
- https://github.com/open5gs/open5gs/issues/4000#issuecomment-3091321920
- https://github.com/open5gs/open5gs/releases/tag/v2.7.6
- https://github.com/user-attachments/files/21229739/smf_crash.zip
- https://vuldb.com/?ctiid.319334
- https://vuldb.com/?id.319334
- https://vuldb.com/?submit.626125
- https://github.com/open5gs/open5gs/issues/4000
- https://github.com/open5gs/open5gs/issues/4000#issuecomment-3091321920
