| Título | Open5GS <= 2.8.0 (latest) Denial of service |
|---|
| Descripción | Open5GS v2.8.0 is affected by a denial-of-service vulnerability caused by a NULL pointer dereference in the SMF PFCP Session Report Request handling path. When an associated UPF sends a crafted PFCP Session Report Request for an existing PDU session with both ERIR (Error Indication Report) and USAR (Usage Report) set, while omitting the Error Indication Report IE and including a Usage Report with a matching URR-ID and UR-SEQN but no Volume Measurement, the SMF first fails to find the expected Error Indication Report/FAR but continues processing the malformed request. The Usage Report then reaches ogs_pfcp_parse_volume_measurement() with an absent Volume Measurement field. Because the parser does not verify that octet->data is non-NULL before dereferencing it, the open5gs-smfd process receives SIGSEGV and terminates. A malicious or compromised UPF, or an attacker capable of impersonating an associated UPF and targeting an existing PDU session with a valid URR-ID, can trigger the condition with a crafted PFCP Session Report Request, causing denial of service of the SMF and disruption of PDU session management. The issue was publicly reported to the Open5GS project in GitHub issue #4745. No public CVE identifier is known for this specific issue at the time of submission. |
|---|
| Fuente | ⚠️ https://github.com/open5gs/open5gs/issues/4745 |
|---|
| Usuario | WeiYi (UID 96864) |
|---|
| Sumisión | 2026-08-20 14:14 (hace 27 días) |
|---|
| Moderación | 2026-09-16 11:37 (27 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 405595 [Open5GS hasta 2.8.0 PFCP lib/pfcp/types.c ogs_pfcp_parse_volume_measurement denegación de servicio] |
|---|
| Puntos | 20 |
|---|