Detection Guidance

You can detect this vulnerability by monitoring network traffic on port N1 for NAS messages containing IMSI strings longer than 1000 characters. Using packet capture tools like tcpdump or Wireshark, you can filter for traffic on port N1 and inspect the IMSI field length. For example, a command like 'tcpdump -i <interface> port <N1_port> -w capture.pcap' can capture relevant traffic, which you can then analyze for oversized IMSI strings. [1]

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a buffer overflow in OpenAirInterface CN5G AMF versions up to 2.1.9. It occurs when processing NAS messages, specifically when an unauthorized remote attacker sends an IMSI string longer than 1000 characters to the AMF via port N1. This can cause the system to overflow its buffer, potentially leading to denial-of-service or execution of malicious code.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow unauthorized remote attackers to launch denial-of-service attacks against the affected system, causing it to become unavailable. Additionally, attackers may be able to execute malicious code remotely, which could compromise the system's integrity and security.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to port N1 to trusted sources only, implementing input validation to reject NAS messages with IMSI strings longer than 1000 characters, and applying any available patches or updates from OpenAirInterface for CN5G AMF versions up to v2.1.9. Additionally, monitoring for unusual traffic patterns and potential exploitation attempts is recommended. [1]

Useful 0 Not Useful 0