Open5GS UPF PFCP Session Establishment Request memcpy f_teid_len potentially dangerous function

Summaryinfo

A vulnerability classified as critical was found in Open5GS UPF. This vulnerability affects the function memcpy of the component PFCP Session Establishment Request Handler. The manipulation of the argument f_teid_len results in use of potentially dangerous function. This vulnerability is reported as CVE-2022-39063. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, was found in Open5GS UPF (version unknown). Affected is the function memcpy of the component PFCP Session Establishment Request Handler. The manipulation of the argument f_teid_len with an unknown input leads to a use of potentially dangerous function vulnerability. CWE is classifying the issue as CWE-676. The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Response. Once UPF receives a request, it gets the f_teid_len from incoming message, and then uses it to copy data from incoming message to struct f_teid without checking the maximum length. If the pdi.local_f_teid.len exceeds the maximum length of the struct of f_teid, the memcpy() overwrites the fields (e.g., f_teid_len) after f_teid in the pdr struct. After parsing the request, the UPF starts to build a response. The f_teid_len with its overwritten value is used as a length for memcpy(). A segmentation fault occurs, as a result of a memcpy(), if this overwritten value is large enough.

The weakness was disclosed 09/17/2022. The advisory is shared for download at synopsys.com. This vulnerability is traded as CVE-2022-39063 since 08/31/2022. There are known technical details, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Open5GS

Name

• UPF

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion