Open5GS Reachable Assertion Vulnerability in NRF Component Leading to Denial-of-Service

A reachable assertion vulnerability has been identified in Open5GS versions prior to 2.7.5. This vulnerability allows attackers with connectivity to the Network Repository Function (NRF) to cause a denial-of-service condition. Exploitation involves sending a creation request for a Network Function (NF) with an invalid type via the Service-Based Interface (SBI), followed by a request for the NF's data. The NRF's process crashes while performing a validity check, causing the discovery service to become unresponsive.

Impact

Exploitation of this vulnerability leads to a crash of the NRF process, causing the discovery service to become unresponsive.

Remediation

Users can upgrade to Open5GS version 2.7.5 to address this vulnerability.