| Título | Open5GS 2.8.0 Out-of-Bounds Read |
|---|
| Descrição | An out-of-bounds read vulnerability exists in Open5GS 2.8.0 in the Rx AA-Request handler of the Policy and Charging Rules Function (PCRF).
A remote Diameter peer that is permitted to communicate with the PCRF over the Rx interface can send an AA-Request containing a Framed-IP-Address AVP whose value is shorter than the required four-byte IPv4 address length.
In pcrf_rx_aar_cb() in src/pcrf/pcrf-rx-path.c, the Framed-IP-Address AVP data pointer is passed directly to pcrf_sess_find_by_ipv4() without first validating hdr->avp_value->os.len.
pcrf_sess_find_by_ipv4() in src/pcrf/pcrf-context.c subsequently calls ogs_hash_get() with OGS_IPV4_LEN as the key length. The default hash implementation therefore processes four bytes from the supplied pointer regardless of the actual AVP value length.
If the Framed-IP-Address AVP contains fewer than four bytes, the PCRF reads beyond the end of the allocated AVP value buffer while calculating or comparing the IPv4 session hash key.
Successful exploitation may cause undefined behavior, an invalid session lookup, or denial of service through a PCRF process crash, depending on the supplied length, adjacent memory contents, allocator behavior, and runtime environment.
Exploitation requires network access to the Rx Diameter interface and the ability to establish or use a Diameter peer relationship accepted by the PCRF. The vulnerability is therefore not expected to be directly reachable by an unauthenticated Internet client in a default deployment.
The PCRF should verify that the Framed-IP-Address AVP value length is exactly OGS_IPV4_LEN, which is four bytes, before using it as an IPv4 hash key. Values of any other length should be rejected with DIAMETER_INVALID_AVP_VALUE. |
|---|
| Fonte | ⚠️ https://github.com/open5gs/open5gs/issues/4663 |
|---|
| Utilizador | WeiYi (UID 96864) |
|---|
| Submissão | 08/07/2026 12h40 (há 2 meses) |
|---|
| Moderação | 23/08/2026 13h34 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 394540 [Open5GS 2.8.0 Rx AA-Request src/pcrf/pcrf-rx-path.c pcrf_rx_aar_cb Divulgação de Informação] |
|---|
| Pontos | 20 |
|---|