Open5GS UDR Component Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Open5GS versions through 2.7.7, specifically within the UDR component. The issue arises in the function 'ogs_dbi_subscription_data' located in the file '/lib/dbi/subscription.c'. The vulnerability is triggered by a malformed 'supi' identifier, which causes an assertion failure, leading to a crash. This issue can be exploited remotely, and has been publicly disclosed.

Impact

Exploitation of this vulnerability causes the Open5GS UDR component to crash, disrupting service.

Reproduction

The vulnerability can be reproduced by sending a request to the UDR endpoint with a prefix-only 'supi' parameter set to 'imsi'. This can be done directly or through a UDM-to-UDR forwarding chain, both of which will result in the same crash.