Open5GS Denial-of-Service Vulnerability in PCF Component

A denial-of-service vulnerability has been identified in Open5GS versions through 2.7.7. The issue arises in the PCF component's sm-policies endpoint, specifically within the pcf_sess_sbi_discover_and_send function. The vulnerability can be exploited remotely, leading to a crash of the PCF process.

Impact

Exploitation of this vulnerability causes the PCF component to crash, disrupting service and requiring a manual restart of the PCF container.

Reproduction

The vulnerability can be reproduced by sending a VPLMN SM Policy Association request that triggers a discovery process with the BSF. If the client disconnects before the discovery response is received, the PCF crashes. This can be done by configuring a fake NRF endpoint that delays responses, sending the SM Policy Association request with a short timeout, and then allowing the delayed response to cause the crash.