| عنوان | Open5GS v2.7.5 Denial of Service |
|---|
| الوصف | Open5GS v2.7.5 is affected by a denial-of-service vulnerability in the SMF Diameter Gx Credit-Control-Answer (CCA) handling path. In a 4G EPC deployment, when multiple UEs attach and detach in quick succession, especially when the same IMSI reattaches before the previous session cleanup has fully completed, the SMF may receive a delayed Gx CCA response for a Diameter transaction whose associated SMF session has already been removed. The callback smf_gx_cca_cb() then attempts to access the removed session and triggers a fatal assertion failure.
As a result, the open5gs-smfd process terminates instead of gracefully ignoring or rejecting the late CCA response. An attacker or misbehaving Diameter peer that can influence Gx CCA timing or send delayed CCA responses may be able to crash the SMF process, causing denial of service for active and new UE sessions.
The issue was publicly reported to the Open5GS project in GitHub issue #4027. No public CVE identifier is known for this specific delayed-CCA-after-session-removal issue at the time of submission. |
|---|
| المصدر | ⚠️ https://github.com/open5gs/open5gs/issues/4027 |
|---|
| المستخدم | WeiYi (UID 96864) |
|---|
| ارسال | 24/06/2026 08:56 AM (2 أشهر منذ) |
|---|
| الاعتدال | 09/08/2026 07:50 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 387283 [Open5GS حتى 2.7.6 SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb الحرمان من الخدمة] |
|---|
| النقاط | 20 |
|---|