Integer Overflow in Open5GS NF Instances Causes DoS

Executive Summary

This vulnerability is an integer overflow in Open5GS version 2.7.6 affecting the /nnrf-disc/v1/nf-instances component. Attackers can send a crafted HTTP/2 GET request with an excessively large value in the requester-features parameter, causing an integer overflow during parsing. This leads to a crash in the Network Repository Function (NRF) due to a fatal assertion error in the string-to-integer conversion function, resulting in a segmentation fault.

Useful 0 Not Useful 0

Detection Guidance

Monitor for crashes in the Open5GS NRF process, particularly after receiving HTTP/2 requests with large values in the 'requester-features' parameter. Check logs for segmentation faults or assertion errors in the NRF component.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a Denial of Service (DoS) by crashing the NRF component of Open5GS. If exploited, it may disrupt network services relying on the NRF, leading to service unavailability for users and systems dependent on this function.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Open5GS to a patched version beyond v2.7.6. Implement input validation to reject malformed HTTP/2 requests with excessively large values in the 'requester-features' parameter. Use network firewalls or WAFs to filter suspicious requests targeting the /nnrf-disc/v1/nf-instances endpoint.

Useful 0 Not Useful 0