Open5GS Denial-of-Service Vulnerability in Policy Control Function

A denial-of-service vulnerability has been identified in Open5GS versions prior to 2.7.7. The issue arises in the Policy Control Function (PCF) component, specifically within the 'flow_rx_to_gx()' function of the 'lib/proto/types.c' file. This vulnerability can be exploited remotely, causing a crash by triggering an assertion failure. The problem stems from a parser and business logic mismatch, where malformed flow descriptions are not properly handled, leading to a process restart.

Impact

Exploitation of this vulnerability causes a crash of the PCF process, disrupting service and requiring a manual intervention to restore functionality.

Reproduction

The vulnerability can be reproduced by sending a POST or PATCH request to the '/npcf-policyauthorization/v1/app-sessions' endpoint with a malformed flow description that includes 'permit in'. This payload will cause the PCF to crash by hitting an assertion in the 'flow_rx_to_gx()' function.