| Titre | Open5GS 2.8.0 Heap Buffer Overflow |
|---|
| Description | An out-of-bounds read vulnerability exists in Open5GS 2.8.0 in the S6a Authentication-Information-Request handler of the Home Subscriber Server (HSS).
A remote Diameter peer that is permitted to communicate with the HSS over the S6a interface can send an Authentication-Information-Request containing a Visited-PLMN-Id AVP whose value is shorter than the required three bytes.
In hss_ogs_diam_s6a_air_cb() in src/hss/hss-s6a-path.c, the supplied AVP value is copied into the local visited_plmn_id structure using a bounded length. However, the original hdr->avp_value->os.data buffer is subsequently passed to ogs_auc_kasme() instead of the bounded local structure.
ogs_auc_kasme(), through ogs_kdf_common() in lib/crypt/ogs-kdf.c, assumes that the PLMN identifier is always OGS_PLMN_ID_LEN bytes long and unconditionally reads three bytes from the supplied buffer. When the Visited-PLMN-Id value is zero, one, or two bytes long, this results in a read past the end of the allocated AVP value buffer.
The vulnerability can cause undefined behavior, incorrect KASME derivation, and potentially a denial of service through an HSS process crash, depending on the memory allocator and runtime environment.
Exploitation requires network access to the S6a Diameter interface and the ability to establish or use a Diameter peer relationship accepted by the HSS. The issue is not expected to be directly exploitable by an unauthenticated Internet client in a default deployment.
The HSS should verify that the Visited-PLMN-Id AVP value is exactly OGS_PLMN_ID_LEN, which is three bytes, before generating authentication vectors. Values of any other length should be rejected with DIAMETER_INVALID_AVP_VALUE. |
|---|
| La source | ⚠️ https://github.com/open5gs/open5gs/issues/4661 |
|---|
| Utilisateur | WeiYi (UID 96864) |
|---|
| Soumission | 08/07/2026 12:38 (il y a 2 mois) |
|---|
| Modérer | 23/08/2026 13:34 (2 months later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 394539 [Open5GS 2.8.0 S6a Authentication-Information-Request src/hss/hss-s6a-path.c hss_ogs_diam_s6a_air_cb Visited-PLMN-Id buffer overflow] |
|---|
| Points | 20 |
|---|