Open5GS SMF Component Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Open5GS versions prior to 2.7.7, specifically within the SMF component. The issue arises in the OpenAPI_list_create function, where improper handling of QoS flow setup data can lead to a crash. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability causes the SMF process to crash, terminating all active transactions.

Reproduction

To reproduce this vulnerability, send a crafted HTTP response to an SMF instance operating in the home-routed V-SMF role. The response should include valid fields but omit the 'qosFlowsSetupList', which is crucial for proper session management. This omission triggers a fatal assertion failure in the SMF, causing it to crash.