| عنوان | Open5GS V2.7.2 Memory Corruption |
|---|
| الوصف | Open5GS c0a520f is affected by a heap-based buffer overflow in open5gs-mmed over the Diameter S6a interface. The vulnerability exists in the handling of subscription data received through Diameter Update-Location-Answer (ULA) and Insert-Subscriber-Data (IDR/ISD) messages. When open5gs-mmed processes a crafted S6a message containing an oversized MSISDN AVP, the code stores the attacker-controlled AVP length in mme_ue->msisdn_len. Although the initial memcpy() into mme_ue->msisdn is capped by OGS_MAX_MSISDN_LEN, the later ogs_buffer_to_bcd() conversion reuses the unchecked original length rather than the capped length. This causes the conversion routine to operate beyond the intended buffer bounds. The same issue also applies to the A-MSISDN AVP. An attacker with access to the Diameter S6a interface can send a crafted ULA or IDR/ISD message to open5gs-mmed and trigger heap memory corruption. The issue may lead to process termination and denial of service, and may have additional impact depending on allocator behavior, build configuration, and runtime protections.
The issue was publicly reported to the Open5GS project in GitHub issue #3156 and fixed through pull request #3183. Open5GS v2.7.2 release notes list this as a security fix: "[SEC] Heap overflow in open5gs-mmed/s6a (#3156)". No public CVE identifier is known for this issue at the time of submission. |
|---|
| المصدر | ⚠️ https://github.com/open5gs/open5gs/issues/3156 |
|---|
| المستخدم | WeiYi (UID 96864) |
|---|
| ارسال | 24/06/2026 08:45 AM (2 أشهر منذ) |
|---|
| الاعتدال | 09/08/2026 07:46 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 387281 [Open5GS حتى 2.7.1 Diameter S6a Interface src/mme/mme-fd-path.c mme_s6a_subscription_data_from_avp msisdn_len تلف الذاكرة] |
|---|
| النقاط | 20 |
|---|