Denial of Service in Open5GS

Executive Summary

This vulnerability exists in Open5GS up to version 2.7.7, specifically in the function amf_nnrf_handle_nf_discover within the AMF component. It occurs when a delayed Network Repository Function (NRF) discovery response is processed after the associated Radio Access Network User Equipment (RAN-UE) context has already been removed. The function attempts to access the RAN-UE context via ran_ue_find_by_id(), which returns NULL if the context is gone. However, the code asserts that this result must not be NULL, causing the AMF process to abort and crash.

This crash leads to a denial of service because the AMF component terminates unexpectedly, dropping all active user sessions until it restarts. The vulnerability can be triggered remotely and is related to handling stale or invalid RAN-UE contexts during NRF discovery responses.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is a denial of service (DoS) condition on the AMF component of Open5GS. When exploited, the AMF crashes and terminates all active user sessions, causing service disruption.

This means that users connected through the affected network may experience dropped connections and inability to access network services until the AMF is restarted and the issue is resolved.

Since the attack can be launched remotely, it poses a risk to network availability and reliability, especially in deployments without proper mitigations or patches applied.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability causes the AMF component of Open5GS to crash due to an assertion failure when processing a delayed NRF Discovery response after the associated RAN-UE context has been removed. Detection can focus on monitoring for unexpected AMF process terminations or crashes.

You can detect this vulnerability by observing AMF crashes or service interruptions, especially following network events such as gNB disconnections or NRF discovery delays.

Suggested commands to detect this issue include:

• Check AMF process status and recent crashes using system logs, e.g., `journalctl -u open5gs-amf` or `systemctl status open5gs-amf`.
• Monitor Open5GS AMF logs for assertion failures or abort messages related to `amf_nnrf_handle_nf_discover`.
• Use network packet capture tools like `tcpdump` or `wireshark` to observe NRF discovery requests and responses, looking for delayed or missing responses.
• Check for abnormal SCTP connection terminations from gNBs, which may trigger the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to apply the patch identified by commit fb5f67703de0213fb9c6e6ef3b48b6c1707e9503, which fixes the issue by adding defensive NULL checks and proper transaction cleanup in the AMF's NRF discovery handling code.

Until the patch is applied, it is recommended to monitor and limit conditions that can trigger the vulnerability, such as avoiding abrupt gNB disconnections and ensuring the NRF discovery responses are timely.

Additionally, enabling or ensuring the Service Communication Proxy (SCP) is active can help, as SCP discovery paths already include proper NULL handling and reduce the chance of this crash.

Restarting the AMF service after a crash can restore service temporarily, but this does not fix the underlying issue.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0