Detection Guidance

This vulnerability causes the AMF component of Open5GS to crash during a UE registration flow when processing a malformed GPSI string in the Nudm_SDM am-data response.

Detection can focus on monitoring the AMF process for unexpected crashes or exit code 134, which indicates an assertion failure triggered by the malformed GPSI.

Additionally, network traffic inspection can be used to identify malformed GPSI values, specifically GPSI strings that contain only "msisdn" without the required hyphen and second token (e.g., "msisdn-1234567890").

Suggested commands to detect this issue include:

• Use system logs or process monitoring tools to check for AMF crashes or restarts, for example: `journalctl -u open5gs-amf` or `systemctl status open5gs-amf`.
• Monitor for exit code 134 in AMF logs indicating assertion failure.
• Capture and inspect network traffic between AMF and UDM to identify malformed GPSI strings using tools like tcpdump or Wireshark, e.g., `tcpdump -i <interface> -A port <udm-port>` and filter for GPSI values.
• Search AMF logs for errors related to `ogs_id_get_value()` or nudm-handler.c assertion failures.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include preventing the AMF from processing malformed GPSI values that cause the crash.

Since the vulnerability is triggered by a malformed GPSI string lacking the required hyphen and second token, validating and sanitizing GPSI inputs before processing can help mitigate the issue.

If possible, restrict or monitor the UDM responses to ensure they do not contain malformed GPSI values.

Additionally, monitor the AMF service for crashes and implement automatic restarts to reduce downtime.

Consider applying any patches or updates from the Open5GS project once available, as the project has been informed but has not yet responded.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a weakness in the Open5GS software, specifically in the function ogs_id_get_value within the file /src/amf/nudm-handler.c of the AMF component. It allows an attacker to cause a denial of service (DoS) condition by manipulating this function. The vulnerability can be exploited remotely, and the exploit code has been made publicly available.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is a denial of service, which means that an attacker could disrupt the normal operation of the affected Open5GS component. This could lead to service outages or degraded performance, potentially affecting users relying on the system.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0