Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Open5GS up to version 2.7.7, specifically in the function amf_nudm_sdm_handle_provisioned within the AMF component. It allows an attacker to remotely manipulate the function, which can lead to a denial of service condition.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is a denial of service, meaning that an attacker can remotely cause the affected system to become unavailable or stop functioning properly.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring the AMF component of Open5GS for crashes or abnormal termination, specifically exit code 134, which indicates an assertion failure caused by a buffer overflow in handling the defaultSingleNssais list.

Detection can involve capturing and analyzing 5G registration procedures where the AMF retrieves subscriber data from the UDM. Look for unusually large defaultSingleNssais lists in the nudm-sdm am-data responses.

While no specific commands are provided in the resources, you can use standard Linux commands to monitor the Open5GS AMF process logs and status, such as:

• journalctl -u open5gs-amf.service -f # To follow AMF service logs in real-time
• ps aux | grep open5gs-amf # To check if the AMF process is running
• grep -i 'assertion failed' /var/log/open5gs/amf.log # To find assertion failure messages

Additionally, network packet capture tools like tcpdump or Wireshark can be used to inspect the 5G registration messages for oversized defaultSingleNssais lists.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include monitoring and restricting the size of the defaultSingleNssais list returned by the UDM to the AMF to ensure it does not exceed the maximum allowed entries (8).

Since the vulnerability arises from a buffer overflow due to lack of bounds checking, applying any available patches or updates from the Open5GS project that address this issue is critical.

If no patch is available yet, consider implementing network-level protections to filter or block malicious UE registration attempts that send oversized defaultSingleNssais lists.

Also, monitor the AMF process for crashes and restart it promptly to minimize service disruption.

Useful 0 Not Useful 0