Open5GS vulnerabilities

In Open5GS up to version 2.7.7, the SMF component's smf_nsmf_handle_create_data_in_hsmf function is vulnerable to a null pointer dereference. The attack can be performed remotely and the exploit has been publicly disclosed.

In Open5GS up to version 2.7.7, a vulnerability in the update_authorized_pcc_rule_and_qos function of the SMF component allows manipulation leading to denial of service (DoS). The attack can be launched remotely, and the exploit is publicly available.

Open5GS up to version 2.7.7 has a vulnerability in the smf_n4_build_qos_flow_to_modify_list function in /src/smf/n4-build.c of the SMF component, leading to denial of service (DoS). The attack can be remote. Exploit has been disclosed.

Open5GS up to version 2.7.7 has a vulnerability in the update_authorized_pcc_rule_and_qos function in /src/smf/npcf-handler.c of the SMF component, leading to denial of service (DoS). The attack can be remote. Exploit has been published.

A vulnerability was detected in Open5GS up to version 2.7.7 in the function update_authorized_pcc_rule_and_qos in the SMF component. Manipulation leads to denial of service. The attack can be launched remotely, and the exploit is publicly available.

A vulnerability was discovered in Open5GS up to version 2.7.7 in the function ogs_pcc_rule_install_flow_from_media in the library /lib/proto/types.c. Manipulation leads to denial of service. The attack can be launched remotely. The exploit is publicly available.

A vulnerability was discovered in Open5GS up to version 2.7.7 in the function pcf_npcf_smpolicycontrol_handle_delete in the file src/pcf/sm-sm.c in the delete Endpoint component. Manipulation leads to denial of service. The attack can be launched remotely. The exploit is publicly available.

In Open5GS up to version 2.7.7, a vulnerability exists in the function pcf_sess_set_ipv6prefix in file /src/pcf/context.c of the PCF component. Manipulation of the argument SmPolicyContextData.ipv6AddressPrefix can lead to denial of service (DoS). The attack can be launched remotely, and the exploit has been publicly disclosed.

Open5GS up to version 2.7.7 has a vulnerability in the pcf_sess_sbi_discover_and_send function of the sm-policies Endpoint component. Input manipulation can lead to denial of service. The attack is remote, and the exploit is public. The project was notified but has not responded.

Open5GS up to version 2.7.7 has a vulnerability in the pcf_nbsf_management_handle_register function in src/pcf/nbsf-handler.c of the sm-policies Endpoint component. Input manipulation leads to denial of service. The attack is remote, and the exploit is public. The project was notified but has not responded.

Open5GS versions up to 2.7.7 contain an out-of-bounds read vulnerability in the function ogs_sbi_client_send_via_scp_or_sepp in the library lib/sbi/client.c in the NF component. An attacker can remotely manipulate data, leading to out-of-bounds read.

In Open5GS up to version 2.7.7, there is a vulnerability in the _gtpv1_u_recv_cb function of src/upf/gtp-path.c in the UPF component. Manipulation leads to resource exhaustion. The attack can be performed remotely. The project has not responded to the report.

A weakness has been identified in Open5GS up to 2.7.6 in the function sgwc_s5c_handle_create_session_response of the file src/sgwc/s5c-handler.c of the GTPv2-C Flow Handler component. The manipulation can lead to denial of service. The attack requires local access, and the exploit is publicly available.

A security flaw has been discovered in Open5GS up to 2.7.6. The function ogs_gtp2_parse_bearer_qos in lib/gtp/v2/types.c of the Bearer QoS IE Length Handler component is affected. Manipulation results in denial of service. The attack must be initiated locally and the exploit has been released to the public.

A vulnerability was identified in Open5GS up to 2.7.6. Affected is the function sgwc_s11_handle_create_session_request of the file src/sgwc/s11-handler.c of the component GTPv2-C F-TEID Handler. Such manipulation leads to denial of service. The attack must be carried out locally. The exploit is publicly available and might be used. The name of the patch is 465273d13ba5d47b274c38c9d1b07f04859178a1. A patch should be applied to remediate this issue.

A flaw has been found in Open5GS up to 2.7.5. This affects the function decode_ipv6_header/ogs_pfcp_pdr_rule_find_by_packet of the file lib/pfcp/rule-match.c of the component PFCP Session Establishment Request Handler. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called b72d8349980076e2c033c8324f07747a86eea4f8. Applying a patch is advised to resolve this issue.

A vulnerability was found in Open5GS up to version 2.7.5 in the function ogs_pfcp_handle_create_pdr in the library lib/pfcp/handler.c of the PFCP component. Manipulation results in improper initialization. The attack can be launched remotely but is difficult to exploit.

A vulnerability was found in Open5GS up to version 2.7.6 in the functions ogs_pfcp_pdr_find_or_add, ogs_pfcp_far_find_or_add, ogs_pfcp_urr_find_or_add, and ogs_pfcp_qer_find_or_add in the library lib/pfcp/context.c. Manipulation leads to a reachable assertion. The attack can be initiated remotely but is difficult to exploit.

A flaw was found in Open5GS up to version 2.7.5 in the function ogs_pfcp_handle_create_pdr in the library lib/pfcp/handler.c of the FAR-ID Handler component. Manipulation leads to null pointer dereference. The attack may be performed remotely but is difficult to exploit.

In Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session Establishment Request (type=50), the UPF crashes with a reachable assertion in lib/pfcp/context.c (ogs_pfcp_object_teid_hash_set) if the CreatePDR/PDI/F-TEID has CH=1 and the F-TEID address-family flags (IPv4/IPv6) do not match the GTP-U resource family configured for the selected DNN (Network Instance), resulting in a denial of service.

Reachable assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with NRF connectivity to cause denial of service. By sending creation of an NF with invalid type via SBI and then requesting its data, the NRF executes a check that crashes the process, leaving discovery service unresponsive.

Reachable assertion vulnerability in Open5GS up to version 2.7.6 allows attackers with connectivity to the NRF to cause a denial of service. An SBI request that deletes the NRF's own registry causes a check that crashes the NRF process and makes the discovery service unavailable.