CVE-2026-117067 in OpenAirInterface
Summary
by MITRE • 11/02/2026
An out-of-bounds memory access vulnerability in the N2 SCTP interface of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly establishing SCTP associations, resulting in a process crash due to improper file descriptor bounds checking in the FD_SET() operation.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified within OpenAirInterface CN5G AMF v2.2.1 represents a critical security flaw located specifically in the N2 interface implementation of the Session Control Protocol (SCTP). This component is responsible for handling signaling traffic between the Access and Mobility Management Function and other network functions in 5G core networks. The root cause lies in improper bounds checking during file descriptor management, particularly within the FD_SET operation used to monitor multiple socket connections. When an unauthenticated remote attacker interacts with this interface by repeatedly establishing SCTP associations, they can trigger a memory access violation that exceeds allocated buffer limits or invalidates expected state constraints. This specific failure mode leads directly to process instability and eventual crash of the AMF service, effectively halting its ability to manage user equipment mobility and session states.
From an operational perspective, this vulnerability poses a severe risk to network availability and integrity. Since the N2 interface is fundamental to 5G control plane operations, compromising it can disrupt critical signaling flows required for device attachment, authentication, and handover procedures. An attacker exploiting this flaw does not need valid credentials or prior access privileges, making it particularly dangerous in exposed environments where the AMF endpoint might be accessible over public networks or poorly segmented internal segments. The resulting denial of service condition means that legitimate users may lose connectivity, and network administrators would face significant downtime while attempting to restart services and restore normal signaling operations. This aligns with common attack patterns observed in distributed denial-of-service campaigns targeting infrastructure components lacking robust input validation and resource limits.
The technical nature of this flaw corresponds closely to CWE-125, which describes out-of-bounds read vulnerabilities where software reads data beyond the intended buffer boundary. In this context, the improper handling of file descriptors during SCTP association setup suggests that the application fails to validate whether the number of active connections or associated file handles exceeds system limits before invoking FD_SET. This oversight allows an attacker to exhaust resources or corrupt internal state structures by forcing the process into an invalid memory access scenario. Such behavior is often categorized under CWE-787, which covers out-of-bounds write vulnerabilities if the crash results from writing beyond allocated memory due to unchecked indices derived from maliciously crafted association requests. The lack of strict validation on connection parameters enables this exploitation path without requiring complex payload construction, relying instead on volume and timing of legitimate-looking but excessive SCTP handshake attempts.
In terms of threat modeling, this vulnerability facilitates attacks that align with MITRE ATT&CK technique T1498, Network Denial of Service, specifically through resource exhaustion or loop-based disruption mechanisms. By repeatedly initiating new connections without properly closing previous ones or validating their legitimacy, the attacker forces the AMF process to consume excessive system resources until it crashes. This method is efficient because it leverages standard protocol behaviors against themselves, making detection by basic intrusion prevention systems difficult unless specific rate-limiting rules are in place. The impact extends beyond simple availability loss; if the crash leads to data corruption or leaves the service in an inconsistent state upon restart, there may be secondary risks related to session hijacking or configuration drift that could compromise broader network security post-recovery.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary solution involves applying vendor-provided patches for OpenAirInterface CN5G AMF v2.2.1 that address the file descriptor bounds checking logic within the SCTP stack implementation. Until such updates are available, administrators should implement network-level controls to limit the rate of new SCTP connections from untrusted sources. This includes configuring firewalls or load balancers to enforce strict connection limits per source IP and dropping excessive handshake attempts before they reach the vulnerable application layer. Additionally enabling logging for abnormal spikes in N2 interface activity can aid in early detection of exploitation attempts.
Long-term resilience requires integrating robust input validation mechanisms into all network-facing components, ensuring that every parameter involved in protocol state transitions is rigorously checked against expected ranges and types. Developers should adopt secure coding practices that prioritize resource management safety, such as using safe wrappers for file descriptor operations or implementing explicit limits on concurrent connections per peer. Regular security audits focusing on memory safety issues like buffer overflows and out-of-bounds accesses are essential to prevent similar flaws in future releases. Furthermore, deploying the AMF behind a Web Application Firewall with specific rulesets targeting SCTP anomalies can provide an additional layer of defense against automated exploitation tools commonly used by threat actors seeking quick wins for denial-of-service objectives.