Open5GS vulnerabilities

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805 with DLPA and DLBY flags set, potentially crashing the UPF.

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_volume_measurement() in lib/pfcp/types.c. A remote unauthenticated attacker can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags Volume Measurement IE, reading up to 48 bytes and potentially crashing the SMF.

A vulnerability has been found in Open5GS up to 2.8.0 in the function smf_n4_handle_session_report_request of the file src/smf/n4-handler.c of the PFCP Session Report Request Handler component. The manipulation leads to a reachable assertion, and the attack may be initiated remotely.

Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows remote unauthenticated attackers to crash the MME via malformed SGSN Address IEs. Attackers sending GTPv1-C traffic from a configured SGSN address with a known UE IMSI or P-TMSI can supply an invalid address length to terminate open5gs-mmed, denying service to all subscribers.

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogs_pfcp_xact_local_create of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Patch name: 9ffc252482d9b03ac01abcedbe95497ff4f95dd0. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Open5GS up to 2.8.0 affecting the function ogs_pfcp_parse_volume_measurement in lib/pfcp/types.c of the PFCP Handler component. The manipulation results in a null pointer dereference. The attack may be launched remotely, and the patch is identified as 8f07b507b78ff94776f2cd49276eb116ed93d7f2.

A security flaw has been discovered in Open5GS up to 2.7.7 in the file lib/pfcp/handler.c of the PFCP Message Handler component. Manipulation leads to denial of service. Remote exploitation is possible, and the exploit has been publicly released. The patch is named 028e1dbb5e3271035ccee906ef417a97fc523f71.

A security flaw has been discovered in Open5GS up to 2.7.x. Affected is the function amf_nnrf_try_old_amf_discovery_fallback of the file src/amf/nnrf-handler.c of the component Old AMF Discovery Fallback. The manipulation of the argument discovery_option results in use after free. The attack may be performed from remote. The patch is identified as ddd683a35f8aaac2b7b9884a24cd53bddfc65238. Applying a patch is advised to resolve this issue.

A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9468de94caed2fc940f4a23cbf734651896d0fde. To fix this issue, it is recommended to deploy a patch.

Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of service via the ogs_sbi_time_parse() function.

A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smf_nudm_sdm_handle_get of the file src/smf/nudm-handler.c of the component SMF. Executing a manipulation of the argument preemptCap can lead to reachable assertion. The attack may be launched remotely. Upgrading to version 2.8.0 is sufficient to fix this issue. This patch is called 4554405f29bffd7562abedbee63484825bd90cd5.

A security flaw has been discovered in Open5GS up to 2.7.7. Impacted is the function amf_namf_comm_handle_n1_n2_message_transfer of the file src/amf/namf-handler.c of the component N1-N2 Message Handler. Performing a manipulation of the argument N1N2MessageTransferReqData.n2InfoContainer.smInfo.n2InfoContent.ngapIeType results in denial of service. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.8.0 is recommended to address this issue. The patch is named abf8a836564b966b5141110fc25ed413c4f17522.

A vulnerability was identified in Open5GS up to 2.7.7. This issue affects some unknown processing of the file src/amf/namf-handler.c of the component Transfer Endpoint. Such manipulation leads to null pointer dereference. The attack can be launched remotely. Upgrading to version 2.8.0 is capable of addressing this issue. The name of the patch is abf8a836564b966b5141110fc25ed413c4f17522.

A vulnerability was determined in Open5GS up to 2.7.7. This vulnerability affects the function amf_namf_comm_decode_ue_mm_context_list of the file src/amf/namf-handler.c of the component AMF. This manipulation of the argument ueContext.mmContextList[*].allowedNssai causes memory corruption. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.8.0 is able to resolve this issue. Patch name: abf8a836564b966b5141110fc25ed413c4f17522.

An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted GTP packet.

A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.

A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.

An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted HTTP/2 GET request.

A flaw was found in Open5GS up to version 2.8.0 in an unknown function of src/hss/hss-cx-path.c in the HSS component. Manipulation of the User-Name argument causes a reachable assertion. The attack can be carried out remotely, and the exploit has been published.

A flaw has been found in Open5GS 2.8.0 in the unknown code of the AMF UEContextReleaseRequest Path Handler component. Executing a manipulation can lead to improper authorization. The attack can be launched remotely.

A vulnerability was detected in Open5GS 2.8.0 in the pcrf_rx_aar_cb function of src/pcrf/pcrf-rx-path.c in the Rx AA-Request Handler component. Manipulation leads to an out-of-bounds read. The attack can be initiated remotely.

A security vulnerability was detected in Open5GS 2.8.0 in the hss_ogs_diam_s6a_air_cb function of src/hss/hss-s6a-path.c in the S6a Authentication-Information-Request Handler component. Manipulation of the Visited-PLMN-Id argument leads to a heap-based buffer overflow. The attack may be performed remotely.

Buffer overflow vulnerability in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the NAS 5GS decoder chain, triggered when the message type byte of a NAS PDU is mutated.

An issue in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the ngap_send_to_nas() function in src/amf/ngap-path.c.

A security flaw in Open5GS up to 2.7.6 affects the smf_gx_cca_cb function of the SMF Diameter Gx Credit-Control-Answer Handler, leading to denial of service. The attack can be launched remotely, and the exploit has been publicly released.

In Open5GS up to 2.7.6, a vulnerability in the fd_msg_sess_get function of the HSS Service component leads to denial of service. The attack can be performed remotely, and the exploit has been publicly disclosed.

A flaw has been found in Open5GS up to 2.7.1. An unknown functionality in the freeDiameter component causes memory corruption. The attack can be carried out remotely.

A vulnerability was detected in Open5GS up to 2.7.6. The function diam_log_func in lib/diameter/common/init.c of the CER Handler component is affected. Manipulation results in reachable assertion. The attack can be executed remotely. The exploit is public. Upgrading to version 2.7.7 addresses the issue.

A vulnerability was identified in Open5GS up to 2.7.1. The function pcrf_rx_aar_cb in src/pcrf/pcrf-rx-path.c of the Diameter Rx Handler component is affected. Manipulation of the arguments num_of_media_component/num_of_sub leads to buffer overflow. The attack can be initiated remotely. The exploit is publicly available. Upgrading to version 2.7.2 addresses the issue.

A vulnerability was determined in Open5GS up to 2.7.1. The function mme_s6a_subscription_data_from_avp in src/mme/mme-fd-path.c of the Diameter S6a Interface component is affected. Manipulation of the argument msisdn_len leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed. Upgrading to version 2.7.2 resolves the issue.

A vulnerability was found in Open5GS up to 2.7.1. This affects the function hss_ogs_diam_s6a_air_cb/hss_ogs_diam_s6a_ulr_cb of the file src/hss/hss-s6a-path.c of the component Diameter S6a Interface. Performing a manipulation of the argument os.len results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 2.7.2 is able to mitigate this issue.

In Open5GS up to version 2.7.7, a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial of service.

A use-after-free vulnerability has been discovered in Open5GS 2.7.7 in the AMF component, specifically in the amf_context_final function in src/amf/context.c. The attack requires local access and the exploit has been publicly released, enabling potential attacks.

A denial of service vulnerability was found in the AMF component of Open5GS up to version 2.7.7. The function amf_nnrf_handle_nf_discover in src/amf/nnrf-handler.c can be exploited remotely to cause a crash. The exploit is publicly available.

A race condition vulnerability was discovered in Open5GS up to version 2.7.6 in the gmm_state_security_mode function of src/amf/gmm-sm.c in the NGAP Handover component. The attack is remote but requires high complexity.

A vulnerability was identified in Open5GS up to 2.7.6 in the NGAP PathSwitchRequest Message Handler component in file src/amf/ngap-handler.c. The manipulation leads to improper authentication. The attack can be initiated remotely and the exploit is publicly available.

In Open5GS up to version 2.7.7, the handle_amf_info function in the /lib/sbi/nnrf-handler.c library of the nf-instances Endpoint component allows resource consumption via manipulation of the nf_info_pool argument. The attack is remotely exploitable and the exploit is publicly available.

In Open5GS up to version 2.7.7, a denial of service vulnerability exists in the ogs_pool_id_calloc function in /lib/sbi/nghttp2-server.c. The attack can be launched remotely and the exploit has been made public.

A vulnerability in Open5GS up to version 2.7.7 in the function ogs_sbi_xact_add in the library /lib/core/ogs-timer.c (ue-authentications Endpoint) allows denial of service (DoS) via manipulation. The attack can be performed remotely, and the exploit is publicly available.

Open5GS up to version 2.7.7 has a vulnerability in the library lib/sbi/nnrf-handler.c (Shared NF-profile Parser component), leading to denial of service.

In Open5GS up to version 2.7.7, the handle_scp_info function in lib/sbi/nnrf-handler.c of the Shared NF-profile Parser component causes an out-of-bounds write. Remote exploitation is possible and the exploit is public.

In the lib/sbi/nnrf-handler.c library in Open5GS up to version 2.7.7, there is a DoS vulnerability through manipulation of the Shared NF-profile Parser. The attack can be launched remotely, and the exploit is publicly available.

Open5GS up to version 2.7.7 has a vulnerability in the OpenAPI_list_create function of the SMF component, leading to denial of service (DoS). The attack can be remote. Exploit has been disclosed.

Open5GS up to version 2.7.7 has a vulnerability in the smf_nsmf_handle_created_data_in_vsmf function of the SMF component, leading to denial of service (DoS). The attack can be remote. Exploit has been published.

In Open5GS up to version 2.7.7, a vulnerability in the gsm_build_pdu_session_establishment_accept function of the SMF component allows manipulation leading to denial of service (DoS). The attack can be launched remotely, and the exploit is publicly available.

In Open5GS up to version 2.7.7, the SMF component's smf_nsmf_handle_create_data_in_hsmf function is vulnerable to a null pointer dereference. The attack can be performed remotely and the exploit has been publicly disclosed.

In Open5GS up to version 2.7.7, a vulnerability in the update_authorized_pcc_rule_and_qos function of the SMF component allows manipulation leading to denial of service (DoS). The attack can be launched remotely, and the exploit is publicly available.

Open5GS up to version 2.7.7 has a vulnerability in the smf_n4_build_qos_flow_to_modify_list function in /src/smf/n4-build.c of the SMF component, leading to denial of service (DoS). The attack can be remote. Exploit has been disclosed.

Open5GS up to version 2.7.7 has a vulnerability in the update_authorized_pcc_rule_and_qos function in /src/smf/npcf-handler.c of the SMF component, leading to denial of service (DoS). The attack can be remote. Exploit has been published.

A vulnerability was detected in Open5GS up to version 2.7.7 in the function update_authorized_pcc_rule_and_qos in the SMF component. Manipulation leads to denial of service. The attack can be launched remotely, and the exploit is publicly available.