Out-of-Bounds Memory Access in OpenAirInterface CN5G AMF

Executive Summary

This vulnerability is an out-of-bounds memory access flaw in the N2 SCTP interface of OpenAirInterface's CN5G AMF software version 2.2.1. It allows an unauthenticated remote attacker to crash the system by repeatedly creating SCTP connections. The crash occurs due to incorrect handling of file descriptors in the FD_SET() operation.

Useful 0 Not Useful 0

Detection Guidance

Monitor AMF logs for repeated SCTP association attempts or crashes. Check for excessive file descriptor usage in the AMF process. Use netstat or ss to inspect active SCTP connections. Look for patterns of rapid connection establishment and teardown.

Useful 0 Not Useful 0

Impact Analysis

If you use OpenAirInterface CN5G AMF v2.2.1, an attacker could exploit this flaw to cause a denial of service by crashing the system. This would disrupt network services relying on the AMF component, leading to service unavailability for users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial-of-service by crashing the AMF process, disrupting control-plane interfaces and UE services. Such disruptions may lead to unauthorized data access or service unavailability, potentially violating GDPR's availability principle or HIPAA's access controls if user data is exposed or services are interrupted.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenAirInterface CN5G AMF to a patched version beyond v2.2.1. Implement rate limiting on SCTP connections to prevent rapid association attempts. Restrict unauthenticated access to the N2 SCTP interface via firewall rules.

Useful 0 Not Useful 0