Can you explain this vulnerability to me?

CVE-2025-8803 is a denial of service (DoS) vulnerability in Open5GS versions up to 2.7.5, specifically in the Access and Mobility Management Function (AMF) component's GPRS Mobility Management (GMM) state machine. The vulnerability occurs in the functions gmm_state_de_registered and gmm_state_exception due to improper handling of Policy Control Function (PCF) response payloads, especially under memory-constrained environments. This improper handling causes the GMM state machine to enter an invalid state, triggering fatal assertions and crashing the AMF process. The crash disrupts ongoing registration sessions and causes partial unavailability of the 5G core control plane. The attack can be launched remotely without authentication by simulating multiple User Equipment (UE) registrations combined with malformed PCF interactions. The issue is mitigated by upgrading Open5GS to version 2.7.6, which includes a patch that adds robust error handling and validation for SBI messages from the PCF. [1, 2, 3, 4]

Useful 0 Not Useful 0

How can this vulnerability impact me? :

This vulnerability can cause denial of service by crashing the Access and Mobility Management Function (AMF) in Open5GS, leading to disruption of all ongoing UE registration sessions and partial unavailability of the 5G core control plane. It affects service availability and core network reliability, especially in environments with limited memory resources such as Docker containers. The impact includes persistent AMF terminations, preventing user equipment from registering, managing sessions, and authenticating subscribers. Although it does not affect data confidentiality or integrity, the loss of availability can severely impact network operations and user connectivity. [1, 2, 3]

Useful 0 Not Useful 0

How can this vulnerability be detected on my network or system? Can you suggest some commands?

Detection of CVE-2025-8803 can be approached by monitoring the Access and Mobility Management Function (AMF) logs for error messages related to SBI POST responses from the NPCF AM policy control service, especially errors indicating unexpected HTTP response statuses or assertion failures in the GMM state machine. Look for log entries containing errors or warnings about invalid service names like "npcf-am-policy-control" or fatal assertions in the gmm_state_de_registered or gmm_state_exception functions. Since the vulnerability causes AMF crashes during UE registration, monitoring for repeated AMF process terminations or service unavailability is also indicative. Specific commands depend on your environment, but generally, you can use system log inspection commands such as `journalctl -u open5gs-amf.service` or `tail -f /var/log/open5gs/amf.log` to watch for these errors. Additionally, network traffic captures focusing on SBI POST requests to the NPCF AM policy control endpoint can be inspected using tools like `tcpdump` or `wireshark` to identify malformed or unexpected payloads triggering the issue. [3, 4]

Useful 0 Not Useful 0

What immediate steps should I take to mitigate this vulnerability?

The immediate and recommended mitigation for CVE-2025-8803 is to upgrade Open5GS to version 2.7.6, which includes a patch that addresses the vulnerability by adding robust error handling and validation in the AMF's GMM state machine. If upgrading immediately is not possible, consider restricting access to the Radio Access Network (RAN) interface to trusted entities only, to reduce the risk of remote exploitation. Additionally, monitor system resources and AMF stability closely to detect and respond to crashes promptly. Applying the patch identified by commit `1f30edac27f69f61cff50162e980fe58fdeb30ca` from the Open5GS GitHub repository is the definitive fix. [1, 4]

Useful 0 Not Useful 0