| 标题 | open5gs Open5GS 2.8.0 and earlier Reachable Assertion |
|---|
| 描述 | A reachable assertion denial-of-service vulnerability exists in Open5GS 2.8.0 in the Home Subscriber Server (HSS) when processing Diameter Cx Multimedia-Auth-Request and Server-Assignment-Request messages.
A remote Diameter peer that is permitted to communicate with the HSS over the Cx interface can send a Multimedia-Auth-Request, command code 303, or a Server-Assignment-Request, command code 301, containing a User-Name AVP with a zero-length value.
The Cx request handlers duplicate the attacker-controlled User-Name AVP into a C string but do not reject an empty string before it is used by the HSS identity lookup routines.
In src/hss/hss-context.c, the impi_find_by_id() and imsi_find_by_id() functions verify only that the supplied pointer is not NULL. They then call ogs_hash_get() using strlen(id) as the hash key length. For an empty User-Name, strlen(id) is zero.
The call reaches ogs_hash_get_debug() in lib/core/ogs-hash.c, which contains an assertion requiring the key length to be nonzero. The zero-length key therefore triggers the assertion, invokes the Open5GS abort path, and terminates the HSS process.
A single malformed Cx request can consequently cause loss of HSS availability and interrupt IMS subscriber authentication or server-assignment operations until the HSS service is restarted.
Exploitation requires network access to the Cx Diameter interface and the ability to establish or use a Diameter peer connection accepted by the HSS, such as a compromised or malicious S-CSCF peer. The issue is not expected to be directly reachable by an unauthenticated Internet client in a normally segmented deployment.
The HSS should reject a User-Name AVP whose effective value is empty before performing identity or hash-table lookups. The impi_find_by_id() and imsi_find_by_id() helper functions should also treat an empty identifier in the same way as a NULL identifier and return NULL rather than calling ogs_hash_get() with a zero-length key. |
|---|
| 来源 | ⚠️ https://github.com/open5gs/open5gs/issues/4675 |
|---|
| 用户 | WeiYi (UID 96864) |
|---|
| 提交 | 2026-07-10 11時27分 (1 月前) |
|---|
| 管理 | 2026-08-23 18時44分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 394568 [Open5GS 直到 2.8.0 HSS src/hss/hss-cx-path.c User-Name 拒绝服务] |
|---|
| 积分 | 20 |
|---|