| शीर्षक | Open5GS v2.7.2 Memory Corruption |
|---|
| विवरण | Open5GS v2.7.2 is affected by a stack-based buffer overflow in open5gs-hssd over the Diameter S6a interface. The vulnerability exists in the handling of Diameter Update-Location-Request (ULR) and Authentication-Information-Request (AIR) messages. When open5gs-hssd processes a crafted S6a AIR or ULR message containing an oversized Visited-PLMN-Id AVP, the code copies hdr->avp_value->os.data into the fixed-size stack variable visited_plmn_id using hdr->avp_value->os.len as the copy length. Because the AVP length is not checked against the destination object size before memcpy(), a malformed Diameter message can corrupt the stack. An attacker with network access to the Diameter S6a listener can send a crafted AIR or ULR message to trigger stack memory corruption in open5gs-hssd. This may result in process termination and denial of service, and may have additional impact depending on build configuration and runtime protections.
The issue was publicly reported to the Open5GS project in GitHub issue #3155 and fixed through pull request #3180. Open5GS v2.7.2 release notes list this as a security fix: "[SEC] Stack overflow in open5gs-hssd/s6a (#3155)". No public CVE identifier is known for this issue at the time of submission. |
|---|
| स्रोत | ⚠️ https://github.com/open5gs/open5gs/issues/3155 |
|---|
| उपयोगकर्ता | WeiYi (UID 96864) |
|---|
| सबमिशन | 24/06/2026 08:43 AM (2 महीनों पहले) |
|---|
| संयम | 09/08/2026 07:46 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 387280 [Open5GS तक 2.7.1 Diameter S6a Interface src/hss/hss-s6a-path.c hss_ogs_diam_s6a_air_cb/hss_ogs_diam_s6a_ulr_cb os.len बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|