| Название | Open5GS v2.7.5 Denial of Service |
|---|
| Описание | Open5GS v2.7.5 is affected by a denial-of-service vulnerability in the SMF Diameter Gx Credit-Control-Answer (CCA) handling path. In a 4G EPC deployment, when multiple UEs attach and detach in quick succession, especially when the same IMSI reattaches before the previous session cleanup has fully completed, the SMF may receive a delayed Gx CCA response for a Diameter transaction whose associated SMF session has already been removed. The callback smf_gx_cca_cb() then attempts to access the removed session and triggers a fatal assertion failure.
As a result, the open5gs-smfd process terminates instead of gracefully ignoring or rejecting the late CCA response. An attacker or misbehaving Diameter peer that can influence Gx CCA timing or send delayed CCA responses may be able to crash the SMF process, causing denial of service for active and new UE sessions.
The issue was publicly reported to the Open5GS project in GitHub issue #4027. No public CVE identifier is known for this specific delayed-CCA-after-session-removal issue at the time of submission. |
|---|
| Источник | ⚠️ https://github.com/open5gs/open5gs/issues/4027 |
|---|
| Пользователь | WeiYi (UID 96864) |
|---|
| Представление | 24.06.2026 08:56 (2 месяцы назад) |
|---|
| Модерация | 09.08.2026 19:50 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 387283 [Open5GS до 2.7.6 SMF Diameter Gx Credit-Control-Answer smf_gx_cca_cb отказ в обслуживании] |
|---|
| Баллы | 20 |
|---|