| 제목 | Open5GS <= 2.8.0 (latest) Denial of service |
|---|
| 설명 | Open5GS v2.8.0 is affected by a denial-of-service vulnerability caused by a NULL pointer dereference in the SMF PFCP Session Report Request handling path. When an associated UPF sends a crafted PFCP Session Report Request for an existing PDU session with both ERIR (Error Indication Report) and USAR (Usage Report) set, while omitting the Error Indication Report IE and including a Usage Report with a matching URR-ID and UR-SEQN but no Volume Measurement, the SMF first fails to find the expected Error Indication Report/FAR but continues processing the malformed request. The Usage Report then reaches ogs_pfcp_parse_volume_measurement() with an absent Volume Measurement field. Because the parser does not verify that octet->data is non-NULL before dereferencing it, the open5gs-smfd process receives SIGSEGV and terminates. A malicious or compromised UPF, or an attacker capable of impersonating an associated UPF and targeting an existing PDU session with a valid URR-ID, can trigger the condition with a crafted PFCP Session Report Request, causing denial of service of the SMF and disruption of PDU session management. The issue was publicly reported to the Open5GS project in GitHub issue #4745. No public CVE identifier is known for this specific issue at the time of submission. |
|---|
| 원천 | ⚠️ https://github.com/open5gs/open5gs/issues/4745 |
|---|
| 사용자 | WeiYi (UID 96864) |
|---|
| 제출 | 2026. 08. 20. PM 02:14 (28 날 ago) |
|---|
| 모더레이션 | 2026. 09. 16. AM 11:37 (27 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 405595 [Open5GS 까지 2.8.0 PFCP lib/pfcp/types.c ogs_pfcp_parse_volume_measurement 서비스 거부] |
|---|
| 포인트들 | 20 |
|---|