Open5GS SMF Component Null Pointer Dereference Vulnerability

A null pointer dereference vulnerability has been identified in Open5GS versions through 2.7.7, specifically within the SMF component's function 'smf_nsmf_handle_create_data_in_hsmf'. The vulnerability arises when a 'PduSessionCreateData' request is sent without the 'vcnTunnelInfo' field. The SMF component crashes due to the missing information, as the code improperly handles the absence of 'vcnTunnelInfo' by attempting to log an error, which inadvertently leads to a crash. This issue can be exploited remotely, causing the SMF process to exit unexpectedly.

Impact

Exploitation of this vulnerability causes the SMF process to crash, disrupting service and potentially leading to a denial of service condition.

Reproduction

To reproduce this vulnerability, send a 'PduSessionCreateData' request to the 'POST /nsmf-pdusession/v1/pdu-sessions' endpoint without including the 'vcnTunnelInfo' field. The SMF component will crash, exiting with a code that indicates a segmentation fault, which is typical for a null pointer dereference.