| 제목 | open5gs Open5GS 2.8.0 and earlier Reachable Assertion |
|---|
| 설명 | A reachable assertion denial-of-service vulnerability exists in Open5GS 2.8.0 in the Home Subscriber Server (HSS) when processing Diameter Cx Multimedia-Auth-Request and Server-Assignment-Request messages.
A remote Diameter peer that is permitted to communicate with the HSS over the Cx interface can send a Multimedia-Auth-Request, command code 303, or a Server-Assignment-Request, command code 301, containing a User-Name AVP with a zero-length value.
The Cx request handlers duplicate the attacker-controlled User-Name AVP into a C string but do not reject an empty string before it is used by the HSS identity lookup routines.
In src/hss/hss-context.c, the impi_find_by_id() and imsi_find_by_id() functions verify only that the supplied pointer is not NULL. They then call ogs_hash_get() using strlen(id) as the hash key length. For an empty User-Name, strlen(id) is zero.
The call reaches ogs_hash_get_debug() in lib/core/ogs-hash.c, which contains an assertion requiring the key length to be nonzero. The zero-length key therefore triggers the assertion, invokes the Open5GS abort path, and terminates the HSS process.
A single malformed Cx request can consequently cause loss of HSS availability and interrupt IMS subscriber authentication or server-assignment operations until the HSS service is restarted.
Exploitation requires network access to the Cx Diameter interface and the ability to establish or use a Diameter peer connection accepted by the HSS, such as a compromised or malicious S-CSCF peer. The issue is not expected to be directly reachable by an unauthenticated Internet client in a normally segmented deployment.
The HSS should reject a User-Name AVP whose effective value is empty before performing identity or hash-table lookups. The impi_find_by_id() and imsi_find_by_id() helper functions should also treat an empty identifier in the same way as a NULL identifier and return NULL rather than calling ogs_hash_get() with a zero-length key. |
|---|
| 원천 | ⚠️ https://github.com/open5gs/open5gs/issues/4675 |
|---|
| 사용자 | WeiYi (UID 96864) |
|---|
| 제출 | 2026. 07. 10. AM 11:27 (1 월 ago) |
|---|
| 모더레이션 | 2026. 08. 23. PM 06:44 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 394568 [Open5GS 까지 2.8.0 HSS src/hss/hss-cx-path.c User-Name 서비스 거부] |
|---|
| 포인트들 | 20 |
|---|