Open5GS SMF Component Denial-of-Service Vulnerability via Malformed NGAP Messages

A denial-of-service vulnerability has been identified in the Session Management Function (SMF) component of Open5GS, prior to version 2.7.5. The issue arises from an assertion failure in the Protocol Configuration Options (PCO) parser, which can be exploited by remote attackers sending specially crafted NGAP messages with malformed length fields in the protocol configuration data. This exploitation causes the SMF process to crash, disrupting service.

Impact

Exploitation of this vulnerability leads to a critical crash of the SMF process, causing a service disruption.

Reproduction

The vulnerability can be reproduced by sending NGAP messages with malformed length fields in the Protocol Configuration Options data to an Open5GS SMF instance. This can be done using a network emulator or fuzzing tool that supports NGAP message manipulation. The SMF process will crash due to the assertion failure, as logged in the SMF error output.

Remediation

Users can update to Open5GS version 2.7.5 or later, where this vulnerability has been fixed.