Open5GS vulnerabilities

An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted HTTP/2 GET request.

An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted GTP packet.

A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.

A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.

A flaw was found in Open5GS up to version 2.8.0 in an unknown function of src/hss/hss-cx-path.c in the HSS component. Manipulation of the User-Name argument causes a reachable assertion. The attack can be carried out remotely, and the exploit has been published.

A flaw has been found in Open5GS 2.8.0 in the unknown code of the AMF UEContextReleaseRequest Path Handler component. Executing a manipulation can lead to improper authorization. The attack can be launched remotely.

A vulnerability was detected in Open5GS 2.8.0 in the pcrf_rx_aar_cb function of src/pcrf/pcrf-rx-path.c in the Rx AA-Request Handler component. Manipulation leads to an out-of-bounds read. The attack can be initiated remotely.

A security vulnerability was detected in Open5GS 2.8.0 in the hss_ogs_diam_s6a_air_cb function of src/hss/hss-s6a-path.c in the S6a Authentication-Information-Request Handler component. Manipulation of the Visited-PLMN-Id argument leads to a heap-based buffer overflow. The attack may be performed remotely.

Buffer overflow vulnerability in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the NAS 5GS decoder chain, triggered when the message type byte of a NAS PDU is mutated.

An issue in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the ngap_send_to_nas() function in src/amf/ngap-path.c.

A security flaw in Open5GS up to 2.7.6 affects the smf_gx_cca_cb function of the SMF Diameter Gx Credit-Control-Answer Handler, leading to denial of service. The attack can be launched remotely, and the exploit has been publicly released.

In Open5GS up to 2.7.6, a vulnerability in the fd_msg_sess_get function of the HSS Service component leads to denial of service. The attack can be performed remotely, and the exploit has been publicly disclosed.

A flaw has been found in Open5GS up to 2.7.1. An unknown functionality in the freeDiameter component causes memory corruption. The attack can be carried out remotely.

A vulnerability was detected in Open5GS up to 2.7.6. The function diam_log_func in lib/diameter/common/init.c of the CER Handler component is affected. Manipulation results in reachable assertion. The attack can be executed remotely. The exploit is public. Upgrading to version 2.7.7 addresses the issue.

A vulnerability was identified in Open5GS up to 2.7.1. The function pcrf_rx_aar_cb in src/pcrf/pcrf-rx-path.c of the Diameter Rx Handler component is affected. Manipulation of the arguments num_of_media_component/num_of_sub leads to buffer overflow. The attack can be initiated remotely. The exploit is publicly available. Upgrading to version 2.7.2 addresses the issue.

A vulnerability was determined in Open5GS up to 2.7.1. The function mme_s6a_subscription_data_from_avp in src/mme/mme-fd-path.c of the Diameter S6a Interface component is affected. Manipulation of the argument msisdn_len leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed. Upgrading to version 2.7.2 resolves the issue.

A vulnerability was found in Open5GS up to 2.7.1. This affects the function hss_ogs_diam_s6a_air_cb/hss_ogs_diam_s6a_ulr_cb of the file src/hss/hss-s6a-path.c of the component Diameter S6a Interface. Performing a manipulation of the argument os.len results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version 2.7.2 is able to mitigate this issue.

In Open5GS up to version 2.7.7, a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial of service.

A use-after-free vulnerability has been discovered in Open5GS 2.7.7 in the AMF component, specifically in the amf_context_final function in src/amf/context.c. The attack requires local access and the exploit has been publicly released, enabling potential attacks.

A denial of service vulnerability was found in the AMF component of Open5GS up to version 2.7.7. The function amf_nnrf_handle_nf_discover in src/amf/nnrf-handler.c can be exploited remotely to cause a crash. The exploit is publicly available.

A race condition vulnerability was discovered in Open5GS up to version 2.7.6 in the gmm_state_security_mode function of src/amf/gmm-sm.c in the NGAP Handover component. The attack is remote but requires high complexity.

A vulnerability was identified in Open5GS up to 2.7.6 in the NGAP PathSwitchRequest Message Handler component in file src/amf/ngap-handler.c. The manipulation leads to improper authentication. The attack can be initiated remotely and the exploit is publicly available.

In Open5GS up to version 2.7.7, the handle_amf_info function in the /lib/sbi/nnrf-handler.c library of the nf-instances Endpoint component allows resource consumption via manipulation of the nf_info_pool argument. The attack is remotely exploitable and the exploit is publicly available.

In Open5GS up to version 2.7.7, a denial of service vulnerability exists in the ogs_pool_id_calloc function in /lib/sbi/nghttp2-server.c. The attack can be launched remotely and the exploit has been made public.

A vulnerability in Open5GS up to version 2.7.7 in the function ogs_sbi_xact_add in the library /lib/core/ogs-timer.c (ue-authentications Endpoint) allows denial of service (DoS) via manipulation. The attack can be performed remotely, and the exploit is publicly available.

Open5GS up to version 2.7.7 has a vulnerability in the library lib/sbi/nnrf-handler.c (Shared NF-profile Parser component), leading to denial of service.

In Open5GS up to version 2.7.7, the handle_scp_info function in lib/sbi/nnrf-handler.c of the Shared NF-profile Parser component causes an out-of-bounds write. Remote exploitation is possible and the exploit is public.

In the lib/sbi/nnrf-handler.c library in Open5GS up to version 2.7.7, there is a DoS vulnerability through manipulation of the Shared NF-profile Parser. The attack can be launched remotely, and the exploit is publicly available.

Open5GS up to version 2.7.7 has a vulnerability in the OpenAPI_list_create function of the SMF component, leading to denial of service (DoS). The attack can be remote. Exploit has been disclosed.

Open5GS up to version 2.7.7 has a vulnerability in the smf_nsmf_handle_created_data_in_vsmf function of the SMF component, leading to denial of service (DoS). The attack can be remote. Exploit has been published.

In Open5GS up to version 2.7.7, a vulnerability in the gsm_build_pdu_session_establishment_accept function of the SMF component allows manipulation leading to denial of service (DoS). The attack can be launched remotely, and the exploit is publicly available.

In Open5GS up to version 2.7.7, the SMF component's smf_nsmf_handle_create_data_in_hsmf function is vulnerable to a null pointer dereference. The attack can be performed remotely and the exploit has been publicly disclosed.

In Open5GS up to version 2.7.7, a vulnerability in the update_authorized_pcc_rule_and_qos function of the SMF component allows manipulation leading to denial of service (DoS). The attack can be launched remotely, and the exploit is publicly available.

Open5GS up to version 2.7.7 has a vulnerability in the smf_n4_build_qos_flow_to_modify_list function in /src/smf/n4-build.c of the SMF component, leading to denial of service (DoS). The attack can be remote. Exploit has been disclosed.

Open5GS up to version 2.7.7 has a vulnerability in the update_authorized_pcc_rule_and_qos function in /src/smf/npcf-handler.c of the SMF component, leading to denial of service (DoS). The attack can be remote. Exploit has been published.

A vulnerability was detected in Open5GS up to version 2.7.7 in the function update_authorized_pcc_rule_and_qos in the SMF component. Manipulation leads to denial of service. The attack can be launched remotely, and the exploit is publicly available.

A vulnerability was discovered in Open5GS up to version 2.7.7 in the function ogs_pcc_rule_install_flow_from_media in the library /lib/proto/types.c. Manipulation leads to denial of service. The attack can be launched remotely. The exploit is publicly available.

A vulnerability was discovered in Open5GS up to version 2.7.7 in the function pcf_npcf_smpolicycontrol_handle_delete in the file src/pcf/sm-sm.c in the delete Endpoint component. Manipulation leads to denial of service. The attack can be launched remotely. The exploit is publicly available.

In Open5GS up to version 2.7.7, a vulnerability exists in the function pcf_sess_set_ipv6prefix in file /src/pcf/context.c of the PCF component. Manipulation of the argument SmPolicyContextData.ipv6AddressPrefix can lead to denial of service (DoS). The attack can be launched remotely, and the exploit has been publicly disclosed.

Open5GS up to version 2.7.7 has a vulnerability in the pcf_sess_sbi_discover_and_send function of the sm-policies Endpoint component. Input manipulation can lead to denial of service. The attack is remote, and the exploit is public. The project was notified but has not responded.

Open5GS up to version 2.7.7 has a vulnerability in the pcf_nbsf_management_handle_register function in src/pcf/nbsf-handler.c of the sm-policies Endpoint component. Input manipulation leads to denial of service. The attack is remote, and the exploit is public. The project was notified but has not responded.

Open5GS versions up to 2.7.7 contain an out-of-bounds read vulnerability in the function ogs_sbi_client_send_via_scp_or_sepp in the library lib/sbi/client.c in the NF component. An attacker can remotely manipulate data, leading to out-of-bounds read.

In Open5GS up to version 2.7.7, there is a vulnerability in the _gtpv1_u_recv_cb function of src/upf/gtp-path.c in the UPF component. Manipulation leads to resource exhaustion. The attack can be performed remotely. The project has not responded to the report.