| 标题 | Open5GS <=v2.7.5 Denail of Service |
|---|
| 描述 | A denial-of-service (DoS) vulnerability exists in Open5GS SMF (version v2.7.5 and earlier), caused by improper validation of SBI stream state under resource-constrained conditions during PDU session release.
This issue is triggered when the SMF operates under strict memory limits, and an HTTP/2 stream (used for SBI communication) has already been closed — for example, after receiving a RST_STREAM from a peer NF. Despite the stream being invalid, the SMF proceeds to process the event without checking the stream's state, leading to a fatal assertion failure in the function smf_state_operational().
Instead of handling the situation gracefully — by skipping the event or logging an error — the SMF crashes on the assertion assert(stream), resulting in termination of the entire SMF process, even though the failure is tied to a single UE context.
A remote attacker could potentially exploit this vulnerability by simulating high churn (frequent PDU session releases) under load, triggering stream closures and causing the SMF to repeatedly crash.
CVSS v4.0 Base Score
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Base Score: 8.8(High) |
|---|
| 来源 | ⚠️ https://github.com/open5gs/open5gs/issues/3978 |
|---|
| 用户 | lixxxiang (UID 88572) |
|---|
| 提交 | 2025-07-31 07時57分 (1 年前) |
|---|
| 管理 | 2025-08-09 09時21分 (9 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 319330 [Open5GS 直到 2.7.5 SMF src/smf/smf-sm.c smf_state_operational stream 拒绝服务] |
|---|
| 积分 | 20 |
|---|