| タイトル | Open5GS <= 2.8.0 (latest) Denial of service |
|---|
| 説明 | Open5GS v2.8.0 is affected by a denial-of-service vulnerability caused by a NULL pointer dereference in the SMF PFCP Session Report Request handling path. When an associated UPF sends a crafted PFCP Session Report Request for an existing PDU session with both ERIR (Error Indication Report) and USAR (Usage Report) set, while omitting the Error Indication Report IE and including a Usage Report with a matching URR-ID and UR-SEQN but no Volume Measurement, the SMF first fails to find the expected Error Indication Report/FAR but continues processing the malformed request. The Usage Report then reaches ogs_pfcp_parse_volume_measurement() with an absent Volume Measurement field. Because the parser does not verify that octet->data is non-NULL before dereferencing it, the open5gs-smfd process receives SIGSEGV and terminates. A malicious or compromised UPF, or an attacker capable of impersonating an associated UPF and targeting an existing PDU session with a valid URR-ID, can trigger the condition with a crafted PFCP Session Report Request, causing denial of service of the SMF and disruption of PDU session management. The issue was publicly reported to the Open5GS project in GitHub issue #4745. No public CVE identifier is known for this specific issue at the time of submission. |
|---|
| ソース | ⚠️ https://github.com/open5gs/open5gs/issues/4745 |
|---|
| ユーザー | WeiYi (UID 96864) |
|---|
| 送信 | 2026年08月20日 14:14 (27 日 ago) |
|---|
| モデレーション | 2026年09月16日 11:37 (27 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 405595 [Open5GS 迄 2.8.0 PFCP lib/pfcp/types.c ogs_pfcp_parse_volume_measurement サービス拒否] |
|---|
| ポイント | 20 |
|---|