Executive brief
Open5GS is an open-source 5G core network implementation. A stack overflow vulnerability in the Diameter Rx protocol handler could allow a remote attacker to crash the PCRF (Policy and Charging Rules Function) component or potentially execute arbitrary code, disrupting 5G service delivery and network operations.
Technical details
A stack buffer overflow exists in the pcrf_rx_aar_cb function (src/pcrf/pcrf-rx-path.c) where the num_of_media_component and num_of_sub counters can exceed array bounds without validation. An attacker can craft malicious Diameter Rx protocol messages containing excessive Media-Component-Description AVPs to overflow the media_component array on the stack. The attack requires network reachability to the PCRF but no authentication. Exploitation results in denial of service or potential code execution. The fix was released in version 2.7.2 (commit 87b4e45) which adds bounds checking before array access.
Affected products
- Open5GS Open5GS up to 2.7.1
Timeline
- 2026-08-12: disclosed
- 2024-05-01: patched: Fixed in version 2.7.2 (commit 87b4e4535c77ded627cdb6f4e4e2e3ea761f40b7)