Heap Out-of-Bounds Read in Open5GS

Executive Summary

Open5GS through version 2.8.0 has a heap out-of-bounds read flaw in the function ogs_pfcp_parse_volume_measurement() located in lib/pfcp/types.c. This issue allows remote unauthenticated attackers to read memory beyond the intended IE buffers by sending a specially crafted PFCP Session Report Request to the SMF on UDP port 8805. The attacker can include a short Volume Measurement IE with all flags set, which may result in reading up to 48 bytes of adjacent memory and potentially crashing the SMF service.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for PFCP Session Report Requests with malformed Volume Measurement IEs on UDP port 8805. Inspect network traffic for unexpected payloads or crashes in the SMF service. Check logs for heap out-of-bounds read errors in Open5GS versions before 2.8.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial of service by crashing the SMF component of Open5GS, disrupting network services. It may also expose sensitive memory contents, potentially leaking information. Attackers could exploit this to gather data or destabilize the network without authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing sensitive data through heap out-of-bounds reads. Unauthorized memory access may lead to leakage of personal or health information if exploited, violating data protection requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Open5GS to version 2.8.1 or later to patch the vulnerability. Block or filter PFCP traffic on UDP port 8805 if not required. Monitor SMF service stability and apply network segmentation to limit exposure.

Useful 0 Not Useful 0