Open5GS SGWC Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Open5GS versions through 2.7.6, specifically within the SGW-C component. The issue arises in the 'sgwc_s11_handle_downlink_data_notification_ack' function, located in 'src/sgwc/s11-handler.c'. This vulnerability can be exploited remotely, causing the SGW-C process to crash by asserting a null or stale bearer reference, which is a known issue that has already been fixed in the codebase.

Impact

Exploitation of this vulnerability leads to a process crash, causing a denial-of-service condition on the affected component.

Reproduction

The vulnerability can be reproduced by sending a delayed GTPv2-C Downlink Data Notification Acknowledgment (DDN Ack) to the SGW-C after the related bearer has been deleted. This can be done by first establishing a session and then manually deleting the bearer before sending the acknowledgment, which will trigger an assertion failure and crash the process.

Remediation

Users are advised to update to the latest version of Open5GS, where this issue has been fixed.