| 제목 | Open5GS 2.7.7 Reachable Assertion leading to Remote Denial of Service |
|---|
| 설명 | A remote denial-of-service vulnerability affects the Open5GS v2.7.7 UPF when processing repeated GTP-U Error Indication messages associated with an existing tunnel/session.
Each matching Error Indication causes the UPF to create a local PFCP transaction and send a PFCP Session Report Request. If the corresponding Session Report Responses are absent or sufficiently delayed, these transactions remain outstanding and consume PFCP transaction and timer resources.
Each PFCP transaction allocates three timer objects (tm_response, tm_holding, and tm_delayed_commit). Once the global timer pool is exhausted, ogs_pfcp_xact_local_create() fails and upf_pfcp_send_session_report_request() returns OGS_ERROR.
In Open5GS v2.7.7, the GTP-U receive path in src/upf/gtp-path.c handles this error with a fatal ogs_assert(), causing open5gs-upfd to abort.
The issue was reproduced with global.max.ue=1024; approximately 5.5k outstanding Session Report transactions were sufficient to exhaust the 16384-entry timer pool in the test environment. The exact threshold is configuration- and timing-dependent.
The Open5GS maintainers acknowledged the report as a security issue and merged a fix that replaces the fatal assertions with recoverable error handling.
Impact is denial of service of the UPF. No confidentiality or integrity impact has been demonstrated. |
|---|
| 원천 | ⚠️ https://github.com/open5gs/open5gs/issues/4792 |
|---|
| 사용자 | ea1809 (UID 100625) |
|---|
| 제출 | 2026. 09. 22. PM 03:03 (16 날 ago) |
|---|
| 모더레이션 | 2026. 10. 07. PM 01:27 (15 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 414968 [Open5GS 까지 2.7.7 GTP-U Receive Path src/upf/gtp-path.c ogs_pfcp_xact_local_create 서비스 거부] |
|---|
| 포인트들 | 20 |
|---|