Open5GS SMF Denial-of-Service Vulnerability via Invalid QoS Callback

A denial-of-service vulnerability has been identified in Open5GS versions through 2.7.7, specifically within the SMF component. The issue arises in the 'update_authorized_pcc_rule_and_qos' function, where the application crashes due to an assertion failure. This occurs when an 'sm-policy-notify' callback includes a 'preemptCap' value that is not recognized, leading the system to incorrectly assume the value was valid. As a result, the SMF process is aborted, causing a crash.

Impact

Exploiting this vulnerability leads to a crash of the SMF process, causing a disruption in service.

Reproduction

The vulnerability can be reproduced by sending a callback to the SMF with an invalid 'preemptCap' value that is not part of the expected OpenAPI enum. This can be done using a crafted JSON payload that includes the invalid value, which will trigger the assertion failure in the SMF, causing it to crash.