| 标题 | Open5GS <= 2.8.0 (latest) Denial of service |
|---|
| 描述 | Open5GS v2.8.0 is affected by a denial-of-service vulnerability caused by a NULL pointer dereference in the SMF PFCP Session Report Request handling path. When an associated UPF sends a crafted PFCP Session Report Request for an existing PDU session with both ERIR (Error Indication Report) and USAR (Usage Report) set, while omitting the Error Indication Report IE and including a Usage Report with a matching URR-ID and UR-SEQN but no Volume Measurement, the SMF first fails to find the expected Error Indication Report/FAR but continues processing the malformed request. The Usage Report then reaches ogs_pfcp_parse_volume_measurement() with an absent Volume Measurement field. Because the parser does not verify that octet->data is non-NULL before dereferencing it, the open5gs-smfd process receives SIGSEGV and terminates. A malicious or compromised UPF, or an attacker capable of impersonating an associated UPF and targeting an existing PDU session with a valid URR-ID, can trigger the condition with a crafted PFCP Session Report Request, causing denial of service of the SMF and disruption of PDU session management. The issue was publicly reported to the Open5GS project in GitHub issue #4745. No public CVE identifier is known for this specific issue at the time of submission. |
|---|
| 来源 | ⚠️ https://github.com/open5gs/open5gs/issues/4745 |
|---|
| 用户 | WeiYi (UID 96864) |
|---|
| 提交 | 2026-08-20 14時14分 (27 日前) |
|---|
| 管理 | 2026-09-16 11時37分 (27 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 405595 [Open5GS 直到 2.8.0 PFCP lib/pfcp/types.c ogs_pfcp_parse_volume_measurement 拒绝服务] |
|---|
| 积分 | 20 |
|---|