CVE-2025-5935: Open5GS DoS Vulnerability in AMF/MME

CVE-2025-5935 Overview

CVE-2025-5935 is a denial of service vulnerability in Open5GS through version 2.7.3. The flaw resides in the common_register_state function within src/mme/emm-sm.c, part of the Access and Mobility Management Function (AMF) and Mobility Management Entity (MME) components. Remote attackers can manipulate the ran_ue_id argument to trigger the condition, causing the affected 5G/LTE core network function to crash. The issue is tracked under [CWE-404: Improper Resource Shutdown or Release]. A public exploit disclosure exists, and the maintainers have released a patch identified by commit 62cb99755243c9c38e4c060c5d8d0e158fe8cdd5.

Critical Impact
Remote attackers can crash the Open5GS AMF/MME component without authentication, disrupting mobile core network operations for connected user equipment.

Affected Products

Open5GS versions up to and including 2.7.3
Open5GS AMF (Access and Mobility Management Function) component
Open5GS MME (Mobility Management Entity) component

Discovery Timeline

2025-06-10 - CVE-2025-5935 published to NVD
2025-08-25 - Last updated in NVD database

Technical Details for CVE-2025-5935

Vulnerability Analysis

The vulnerability affects the state machine logic that processes registration messages within the Open5GS mobile core network stack. The common_register_state function looks up a Radio Access Network User Equipment (RAN UE) context using the ran_ue_id identifier supplied during handover and registration flows. The pre-patch code called ogs_assert(ran_ue) and ogs_assert_if_reached() when the lookup returned no matching context. Because Open5GS treats failed assertions as fatal, an attacker who triggers a missing UE context forces the daemon to terminate. The CWE-404 classification reflects the improper handling of a resource that fails to materialize during expected protocol exchanges.

Root Cause

The root cause is the use of fatal assertions in code paths that handle attacker-influenced state. When the RAN UE or eNB UE context cannot be located by ran_ue_find_by_id or enb_ue_find_by_id, the process aborts rather than logging the anomaly and continuing. The handover-required message flow can be crafted to produce this missing-context condition.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with access to the signaling interfaces of the Open5GS deployment can send a malformed or out-of-sequence handover-required message that causes the AMF or MME to dereference a non-existent UE context. The affected process terminates, denying service to all connected subscribers until the daemon restarts.

// Patch from src/mme/emm-sm.c - replaces fatal abort with graceful handling
enb_ue = enb_ue_find_by_id(mme_ue->enb_ue_id);
if (!enb_ue) {
-    ogs_fatal("No S1 Context IMSI[%s] NAS-Type[%d] "
+    ogs_error("No S1 Context IMSI[%s] NAS-Type[%d] "
             "ENB-UE-ID[%d:%d][%p:%p]",
             mme_ue->imsi_bcd, message->emm.h.message_type,
             e->enb_ue_id, mme_ue->enb_ue_id,
             enb_ue_find_by_id(e->enb_ue_id),
             enb_ue_find_by_id(mme_ue->enb_ue_id));
    ogs_assert(e->pkbuf);
-    ogs_log_hexdump(OGS_LOG_FATAL, e->pkbuf->data, e->pkbuf->len);
-    ogs_assert_if_reached();
+    ogs_log_hexdump(OGS_LOG_ERROR, e->pkbuf->data, e->pkbuf->len);
+    break;
}

Source: Open5GS commit 62cb997

Detection Methods for CVE-2025-5935

Indicators of Compromise

Unexpected termination or restart of Open5GS amfd or mmed processes
Log entries containing ogs_fatal messages referencing No S1 Context or No NG Context immediately before process exit
Hex dumps of NAS or NGAP packets logged at FATAL severity prior to a crash
Spikes in handover-required signaling from a single eNB or gNB peer

Detection Strategies

Monitor process supervisors (systemd, container runtimes) for repeated restart events of AMF and MME services
Correlate signaling-plane packet captures with daemon crash timestamps to identify malformed handover messages
Track ran_ue_id values referenced in error logs to spot identifiers that do not map to active UE contexts

Monitoring Recommendations

Enable verbose logging on Open5GS AMF and MME and forward logs to a central analytics platform for alerting on fatal assertions
Baseline normal handover request rates per RAN node and alert on deviations
Inspect S1AP and NGAP traffic for handover-required messages referencing unknown UE identifiers

How to Mitigate CVE-2025-5935

Immediate Actions Required

Upgrade Open5GS to a build that includes commit 62cb99755243c9c38e4c060c5d8d0e158fe8cdd5 or a later release
Restrict network access to S1-MME and N2 signaling interfaces to trusted RAN peers only
Enable automatic process restart for amfd and mmed to limit outage duration if exploitation occurs

Patch Information

The fix is published in Open5GS commit 62cb997. It modifies common_register_state in both src/amf/gmm-sm.c and src/mme/emm-sm.c to replace ogs_fatal and ogs_assert_if_reached calls with ogs_error logging followed by a break statement. The daemon now logs the missing UE context and continues processing rather than aborting. See the GitHub issue discussion for additional technical context.

Workarounds

Place AMF and MME components behind network segmentation that allows only authenticated RAN nodes to reach signaling ports
Deploy rate limiting on S1AP and NGAP handover-required messages at the network edge
Use a process manager that automatically restarts crashed core network functions to minimize service disruption until patching is complete

bash

# Build and deploy patched Open5GS from source
git clone https://github.com/open5gs/open5gs.git
cd open5gs
git checkout 62cb99755243c9c38e4c060c5d8d0e158fe8cdd5
meson build --prefix=`pwd`/install
ninja -C build
ninja -C build install
systemctl restart open5gs-amfd open5gs-mmed