Description
Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows remote unauthenticated attackers to crash the MME via malformed SGSN Address IEs. Attackers sending GTPv1-C traffic from a configured SGSN address with a known UE IMSI or P-TMSI can supply an invalid address length to terminate open5gs-mmed, denying service to all subscribers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| open5gs | open5gs | ≤ 2.8.0 | — |
References
- Patch Commit patch
- https://github.com/open5gs/open5gs product
- GitHub Security Advisory (GHSA-9crh-64c8-56q6) vendor-advisory
- https://github.com/open5gs/open5gs/blob/v2.8.0/src/mme/mme-gn-handler.c#L208-L217 technical-description
- VulnCheck Advisory: Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request third-party-advisory