Memory Exhaustion in Open5GS via HTTP/2 Headers

Executive Summary

This vulnerability is a memory exhaustion issue in Open5GS v2.8.0's HTTP/2 SBI server. It occurs when repeated header names in requests cause memory leaks. HPACK compression allows an attacker to send tens of thousands of duplicate headers with a small request, leading to persistent heap growth and process memory exhaustion. This can terminate the affected Open5GS network function, causing a denial of service.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusual memory consumption in Open5GS processes, especially NRF, SMF, or UDM. Check for repeated HTTP/2 header fields in network traffic logs. Use tools like tcpdump or Wireshark to capture and analyze HTTP/2 traffic for malformed headers.

Useful 0 Not Useful 0

Impact Analysis

An unauthenticated remote attacker could exploit this to crash your Open5GS network functions (like NRF, SMF, or UDM) by sending specially crafted requests. This would disrupt your 5G network services, potentially causing downtime or loss of connectivity for users relying on these functions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service by exhausting memory, which could disrupt critical network functions. While not directly violating GDPR or HIPAA, such disruptions may impact availability of systems handling personal or health data, potentially leading to compliance issues if service outages affect data processing or access.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Open5GS to a patched version addressing the memory leak. Apply the fix from commit 76f15375ead1b2db09193458e56640da0a86c255. Limit HTTP/2 header sizes and enforce header list size constraints to prevent amplification attacks.

Useful 0 Not Useful 0