Open5GS SMF Component Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Open5GS versions prior to 2.7.7, specifically within the SMF component. The issue arises in the function 'smf_nsmf_handle_created_data_in_vsmf', where the absence of 'hcnTunnelInfo' in the 'PduSessionCreatedData' response can lead to a crash. This vulnerability can be exploited remotely, causing the SMF process to terminate unexpectedly.

Impact

Exploitation of this vulnerability causes the SMF process to crash, exiting with a code indicating a segmentation fault.

Reproduction

The vulnerability can be reproduced by sending a '201 Created' response to an SMF instance in home-routed V-SMF mode, omitting the 'hcnTunnelInfo' from the 'PduSessionCreatedData'. This can be done by configuring a fake H-SMF server to respond with the crafted data after the SMF has initiated a session creation request.