Description
Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| open5gs | open5gs | 1.3.0 – ≤ 2.8.0 | — |
References
- GitHub Security Advisory (GHSA-25v2-v588-jq8g) vendor-advisory
- Patch Commit patch
- https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/message.c#L3372 technical-description
- https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/contrib/multipart_parser.c#L260 technical-description
- https://github.com/open5gs/open5gs product
- VulnCheck Advisory: Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser third-party-advisory