CVE-2025-1893: Open5GS AMF Denial of Service Vulnerability

CVE-2025-1893 Overview

CVE-2025-1893 is a denial of service vulnerability in Open5GS through version 2.7.2. The flaw resides in the gmm_state_authentication function within src/amf/gmm-sm.c, a core component of the Access and Mobility Management Function (AMF). A single User Equipment (UE) can trigger the condition remotely with low privileges, crashing the AMF process. When the AMF terminates, all registered UEs lose connectivity, and new registrations are blocked until the service restarts. The vulnerability is tracked as improper resource handling [CWE-404] and was patched in commit e31e9965f00d9c744a7f728497cb4f3e97744ee8.

Critical Impact
A single malicious or malformed UE can crash the AMF, producing a network-wide outage across mobility and session management services until manual restart.

Affected Products

Open5GS versions up to and including 2.7.2
Open5GS AMF component (src/amf/gmm-sm.c)
Deployments using Open5GS as 5G core or EPC implementation

Discovery Timeline

2025-03-04 - CVE-2025-1893 published to the National Vulnerability Database
2025-03-06 - Last updated in NVD database
Patch commit - e31e9965f00d9c744a7f728497cb4f3e97744ee8 merged to the Open5GS repository

Technical Details for CVE-2025-1893

Vulnerability Analysis

The vulnerability exists in the AMF state machine handler gmm_state_authentication in src/amf/gmm-sm.c. During UE handover, the AMF interacts with the Unified Data Management (UDM) function through Service Based Interface (SBI) requests. When the AMF receives an unexpected SBI response status code from the nudm-sdm service while in the authentication state, the handler fails to process the response gracefully and triggers an assertion that terminates the AMF process.

Because the AMF is the central control point for 5G mobility management, its termination disconnects all registered UEs. New registrations and session establishments are blocked until an operator restarts the service. The attack is reachable over the network and requires only the privileges held by a normal UE.

Root Cause

The handler did not enumerate valid resource components for OGS_SBI_SERVICE_NAME_NUDM_SDM responses received during the authentication state. Unexpected response codes or resource names fell through into an ogs_assert_if_reached() path, halting the process rather than logging and continuing.

Attack Vector

A remote UE issues a registration or handover sequence that causes the AMF to query UDM SDM resources. By inducing or relaying an SBI response with a status code or resource component not handled by gmm_state_authentication, the attacker forces the AMF into the unhandled branch. The result is an assertion failure and process termination.

// Patch excerpt from src/amf/gmm-sm.c
CASE(OGS_SBI_SERVICE_NAME_NUDM_SDM)
    if ((sbi_message->res_status != OGS_SBI_HTTP_STATUS_OK) &&
        (sbi_message->res_status != OGS_SBI_HTTP_STATUS_CREATED) &&
        (sbi_message->res_status != OGS_SBI_HTTP_STATUS_NO_CONTENT)) {
        ogs_error("[%s] HTTP response error [%d]",
                  amf_ue->supi, sbi_message->res_status);
    }

    SWITCH(sbi_message->h.resource.component[1])
    CASE(OGS_SBI_RESOURCE_NAME_AM_DATA)
    CASE(OGS_SBI_RESOURCE_NAME_SMF_SELECT_DATA)
    CASE(OGS_SBI_RESOURCE_NAME_UE_CONTEXT_IN_SMF_DATA)
    CASE(OGS_SBI_RESOURCE_NAME_SDM_SUBSCRIPTIONS)
        ogs_warn("[%s] Ignore SBI message", amf_ue->supi);
        break;

    DEFAULT
        ogs_error("Invalid resource name [%s]",
                sbi_message->h.resource.component[1]);
        ogs_assert_if_reached();
    END
    break;

Source: Open5GS patch commit e31e9965. The fix adds explicit handling for nudm-sdm responses, logs the unexpected status, and ignores known resource types instead of asserting.

Detection Methods for CVE-2025-1893

Indicators of Compromise

Unexpected AMF process termination with ogs_assert_if_reached entries in Open5GS logs
Mass loss of UE connectivity coinciding with AMF restart events
SBI error messages referencing nudm-sdm with non-2xx HTTP response codes from UDM
Repeated registration or handover attempts from a single UE preceding an AMF crash

Detection Strategies

Monitor AMF process supervisor events (systemd, container restarts) for unscheduled restarts of the open5gs-amfd service
Inspect AMF stderr and structured logs for Invalid resource name errors against the SDM service path
Correlate UE signaling sequences with AMF availability gaps in NWDAF or operator telemetry

Monitoring Recommendations

Forward Open5GS logs to a centralized logging or SIEM platform and alert on assertion failures in the AMF
Track AMF uptime, NGAP active connection counts, and registration success rates as health signals
Apply rate limiting and anomaly detection on N1/N2 signaling per UE identifier to flag abusive handover patterns

How to Mitigate CVE-2025-1893

Immediate Actions Required

Upgrade Open5GS to a build that includes commit e31e9965f00d9c744a7f728497cb4f3e97744ee8 or later
Audit AMF deployments for exposure of SBI and N1/N2 interfaces to untrusted networks
Enable process supervision so the AMF restarts quickly if terminated, reducing outage duration

Patch Information

The upstream fix is delivered in commit e31e9965f00d9c744a7f728497cb4f3e97744ee8 to src/amf/gmm-sm.c. The patch adds a CASE(OGS_SBI_SERVICE_NAME_NUDM_SDM) branch that validates HTTP response status and explicitly ignores known SDM resource components rather than asserting. Operators should rebuild from a tagged release containing this commit. See the Open5GS commit and the associated issue #3707 for details.

Workarounds

Restrict access to the AMF N1/N2 interfaces using network segmentation and firewall rules limiting traffic to trusted gNodeBs
Deploy redundant AMF instances behind an NF set so a single crash does not produce a full outage
Configure automatic service restart with short backoff intervals as a temporary measure until patching

bash

# Verify the running Open5GS AMF includes the fix commit
cd /path/to/open5gs
git log --oneline | grep e31e9965

# Rebuild and reinstall after applying the patch
meson build --prefix=`pwd`/install
ninja -C build
ninja -C build install

# Restart the AMF service
systemctl restart open5gs-amfd
systemctl status open5gs-amfd