Denial of Service in Open5GS via ngap_send_to_nas()

Executive Summary

This vulnerability is a memory leak in Open5GS v2.7.0 affecting the AMF component. It occurs in the ngap_send_to_nas() function when processing malformed NAS PDUs with invalid security header types. The function allocates memory for the packet but fails to free it before returning an error, causing progressive memory exhaustion upon repeated exploitation.

Useful 0 Not Useful 0

Detection Guidance

Monitor memory usage on the Open5GS AMF component for gradual increases, which may indicate memory leaks. Use tools like ps, top, or htop to track memory consumption over time. Check logs for repeated errors related to NAS PDU processing or memory allocation failures in src/amf/ngap-path.c.

Useful 0 Not Useful 0

Impact Analysis

An attacker with network access to the AMF's N2 interface can exploit this to cause a denial of service by exhausting system memory. This leads to degraded performance or crashes of the Open5GS service, potentially disrupting mobile network operations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Open5GS to the latest version beyond v2.7.7 where this issue is resolved. If upgrading is not immediately possible, restrict network access to the AMF's N2 interface using firewalls or network segmentation to limit exposure to potential attackers.

Useful 0 Not Useful 0