Open5GS SMF Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Open5GS versions prior to 2.7.7, specifically within the Session Management Function (SMF). The issue arises in the 'update_authorized_pcc_rule_and_qos' function of 'npcf-handler.c'. Remote exploitation is possible, and the vulnerability has been publicly disclosed.

Impact

Exploitation of this vulnerability leads to a crash of the SMF process, causing a denial-of-service condition where the service is abruptly terminated and unavailable.

Reproduction

The vulnerability can be reproduced by sending a malformed 'sm-policy-notify' callback that includes a 'flowInfos' object missing the 'flowDescription' field. This can be done using a Python script to craft the callback payload, which is then sent via a curl command to the appropriate SMF callback endpoint. The SMF process will crash, exiting with a code that indicates a segmentation fault, which is a common sign of a denial-of-service condition.