Open5GS UDR Denial-of-Service Vulnerability via Improper PEI Handling

A denial-of-service vulnerability has been identified in Open5GS versions through 2.7.7, specifically within the UDR component. The issue arises in the function 'udr_nudr_dr_handle_subscription_context' located in 'nudr-handler.c'. The vulnerability is triggered by manipulating the 'pei' argument, leading to a crash of the UDR process. This issue can be exploited remotely, causing the container to restart automatically after the crash.

Impact

Exploiting this vulnerability causes the UDR process to crash, with the container restarting automatically, disrupting service.

Reproduction

The vulnerability can be reproduced by sending a 'PUT' request to the '/nudr-dr/v1/subscription-data/{supi}/context-data/amf-3gpp-access' endpoint with an invalid 'pei' value that does not conform to the expected format. The UDR logs will show a fatal error indicating an unknown 'pei' type, and the process will crash, causing the container to restart.