| 제목 | Open5GS v2.7.5 Denial of Service |
|---|
| 설명 | Open5GS v2.7.5 is affected by a denial-of-service vulnerability in the SMF Diameter Gx Credit-Control-Answer (CCA) handling path. In a 4G EPC deployment, when multiple UEs attach and detach in quick succession, especially when the same IMSI reattaches before the previous session cleanup has fully completed, the SMF may receive a delayed Gx CCA response for a Diameter transaction whose associated SMF session has already been removed. The callback smf_gx_cca_cb() then attempts to access the removed session and triggers a fatal assertion failure.
As a result, the open5gs-smfd process terminates instead of gracefully ignoring or rejecting the late CCA response. An attacker or misbehaving Diameter peer that can influence Gx CCA timing or send delayed CCA responses may be able to crash the SMF process, causing denial of service for active and new UE sessions.
The issue was publicly reported to the Open5GS project in GitHub issue #4027. No public CVE identifier is known for this specific delayed-CCA-after-session-removal issue at the time of submission. |
|---|
| 원천 | ⚠️ https://github.com/open5gs/open5gs/issues/4027 |
|---|
| 사용자 | WeiYi (UID 96864) |
|---|
| 제출 | 2026. 06. 24. AM 08:56 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 09. PM 07:50 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 387283 [Open5GS 까지 2.7.6 SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb 서비스 거부] |
|---|
| 포인트들 | 20 |
|---|