Heap Out-of-Bounds Write in Open5GS

Executive Summary

Open5GS versions 1.3.0 to 2.8.0 have a heap out-of-bounds write flaw in the parse_multipart() function. Attackers can exploit this by sending a crafted multipart/related request with an empty boundary to the SBI interface of any network function. This causes a buffer overflow in the lookbehind buffer, leading to memory corruption and potential crashes.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for malformed multipart requests targeting the SBI interface of Open5GS. Check web server logs for unusual requests with empty multipart boundaries. Use network traffic analysis tools like tcpdump or Wireshark to inspect HTTP requests for malformed multipart headers. Example command: tcpdump -i any -A 'tcp port 7777 and (http or http2)' | grep -i 'boundary='

Monitor Open5GS logs for crashes or memory corruption errors in network functions. Look for segmentation faults or heap corruption messages in system logs. Example command: journalctl -u open5gs-* --no-pager | grep -i 'segfault\|heap\|corruption'

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers can exploit this to crash network functions, causing service disruptions. The vulnerability may allow further memory manipulation, potentially leading to remote code execution or unauthorized access to sensitive data processed by Open5GS.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations using affected Open5GS versions may face compliance violations and legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Open5GS to version 2.8.1 or later, which patches the heap out-of-bounds write in parse_multipart(). If upgrading is not immediately possible, apply network-level mitigations such as blocking malformed multipart requests at the firewall or reverse proxy level.

Restrict access to the SBI interface to trusted networks only. Disable unnecessary network functions if they are not in use. Monitor for exploitation attempts and investigate any crashes or unusual activity in Open5GS services.

Useful 0 Not Useful 0