| शीर्षक | Open5GS v2.7.2 Memory Corruption |
|---|
| विवरण | Open5GS v2.7.2 is affected by a stack-based buffer overflow in open5gs-pcrfd over the Diameter Rx interface. The vulnerability exists in the handling of Diameter AA-Request (AAR) messages in src/pcrf/pcrf-rx-path.c. When open5gs-pcrfd processes a crafted Rx AAR message containing excessive Media-Component-Description or Media-Sub-Component AVPs, the indexes rx_message.ims_data.num_of_media_component and media_component->num_of_sub can overflow. These indexes are then used to select entries in fixed-size stack-based arrays without sufficient bounds checking. As a result, a crafted Diameter Rx message can move a write pointer outside the intended stack object and overwrite stack memory with attacker-controlled 4-byte values. An attacker with network access to the Diameter Rx listener can send a crafted AAR message to trigger stack memory corruption in open5gs-pcrfd. This may result in process termination and denial of service, and may have additional impact depending on build configuration and runtime protections. |
|---|
| स्रोत | ⚠️ https://github.com/open5gs/open5gs/issues/3157 |
|---|
| उपयोगकर्ता | WeiYi (UID 96864) |
|---|
| सबमिशन | 24/06/2026 08:47 AM (2 महीनों पहले) |
|---|
| संयम | 09/08/2026 07:50 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 387282 [Open5GS तक 2.7.1 Diameter Rx src/pcrf/pcrf-rx-path.c pcrf_rx_aar_cb num_of_media_component/num_of_sub बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|