| Titel | Open5GS v2.7.2 Memory Corruption |
|---|
| Beschreibung | Open5GS v2.7.2 is affected by a stack-based buffer overflow in open5gs-hssd over the Diameter S6a interface. The vulnerability exists in the handling of Diameter Update-Location-Request (ULR) and Authentication-Information-Request (AIR) messages. When open5gs-hssd processes a crafted S6a AIR or ULR message containing an oversized Visited-PLMN-Id AVP, the code copies hdr->avp_value->os.data into the fixed-size stack variable visited_plmn_id using hdr->avp_value->os.len as the copy length. Because the AVP length is not checked against the destination object size before memcpy(), a malformed Diameter message can corrupt the stack. An attacker with network access to the Diameter S6a listener can send a crafted AIR or ULR message to trigger stack memory corruption in open5gs-hssd. This may result in process termination and denial of service, and may have additional impact depending on build configuration and runtime protections.
The issue was publicly reported to the Open5GS project in GitHub issue #3155 and fixed through pull request #3180. Open5GS v2.7.2 release notes list this as a security fix: "[SEC] Stack overflow in open5gs-hssd/s6a (#3155)". No public CVE identifier is known for this issue at the time of submission. |
|---|
| Quelle | ⚠️ https://github.com/open5gs/open5gs/issues/3155 |
|---|
| Benutzer | WeiYi (UID 96864) |
|---|
| Einreichung | 24.06.2026 08:43 (vor 2 Monaten) |
|---|
| Moderieren | 09.08.2026 19:46 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 387280 [Open5GS bis 2.7.1 Diameter S6a Interface src/hss/hss-s6a-path.c hss_ogs_diam_s6a_air_cb/hss_ogs_diam_s6a_ulr_cb os.len Pufferüberlauf] |
|---|
| Punkte | 20 |
|---|