Heap Out-of-Bounds Read in Open5GS AMF NAS 5GS

Executive Summary

This is a pre-authentication heap out-of-bounds read vulnerability in Open5GS versions up to 2.7.7. It occurs in the AMF NAS 5GS mobile-identity handler when processing maliciously crafted messages with a GUTI or 5G-S-TMSI declared shorter than the required minimum length. The flaw allows a rogue gNB to crash the AMF by triggering a heap buffer overflow.

Useful 0 Not Useful 0

Detection Guidance

Monitor AMF logs for crashes or abnormal terminations when processing NAS messages. Check for malformed GUTI or 5G-S-TMSI fields in NAS Registration, Deregistration, or Service Request messages. Use network traffic analyzers like Wireshark to inspect NAS protocol messages for identity fields shorter than required minimum lengths.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause a subscriber-wide denial of service. If exploited, it crashes the AMF, dropping all connected UEs (User Equipment) served by that AMF. This disrupts mobile network services for all subscribers relying on the affected AMF.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Open5GS to a patched version beyond 2.7.7. Apply input validation to enforce minimum length checks for GUTI and 5G-S-TMSI fields in NAS messages. Isolate vulnerable AMF instances from untrusted gNBs until patched.

Useful 0 Not Useful 0