提交 #626123: Open5GS <= v2.7.5 Denial of Service

A denial of service vulnerability exists in Open5GS AMF (v2.7.5 and earlier) that can be triggered during the handling of PCF (Policy Control Function) response payloads. When multiple UEs attempt to register under constrained memory conditions, the AMF enters an invalid state within its GMM (GPRS Mobility Management) state machine due to improperly handled service names in the PCF response.
This causes a fatal assertion in the AMF process, explicitly reaching a code path marked as "should not be reached". As a result, the AMF crashes and all registration sessions are disrupted, rendering the 5G core control plane partially unavailable. The issue is exacerbated in low-resource environments, such as memory-constrained Docker deployments.
An attacker with access to the RAN interface could exploit this flaw by simulating multiple UE registrations and malformed PCF interactions, leading to repeated AMF termination and service denial across the network.

This vulnerability is remotely exploitable without authentication, has a low attack complexity, and results in a high impact on service availability and the reliability of core 5G control plane operations.Although the flaw does not affect data confidentiality or integrity, it leads to a persistent denial of service (DoS) by crashing the Access and Mobility Management Function (AMF), thereby disrupting UE registration, session management, and subscriber authentication.
CVSS v4.0 Base Score: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H (High severity).
Given its ease of exploitation and significant operational impact, the vulnerability is considered highly critical in production or testbed 5G deployments using Open5GS.

• 来源: ⚠️ https://github.com/open5gs/open5gs/issues/3948
• 用户: xiaohan zheng (UID 88539)
• 提交: 2025-07-31 08時04分 (1 年前)
• 管理: 2025-08-09 09時37分 (9 days later)
• 状态: 已接受
• VulDB条目: 319332 [Open5GS 直到 2.7.5 AMF src/amf/gmm-sm.c gmm_state_de_registered/gmm_state_exception 拒绝服务]
• 积分: 20