Executive brief
A memory management flaw was discovered in Open5GS, an open-source implementation of 5G Core and EPC mobile networks. The issue occurs during the shutdown process of the Access and Mobility Management Function (AMF) component, which handles subscriber connectivity. While a proof-of-concept exploit exists, the practical impact is low as it only involves a minor memory read error during system power-down and requires local access to the server.
Technical details
A use-after-free (UAF) vulnerability exists in Open5GS 2.7.7 within the AMF component's teardown sequence. The flaw is located in `src/amf/context.c` in the `amf_context_final()` function, which interacts with `ogs_hash_destroy()` in `lib/core/ogs-hash.c`. During shutdown (e.g., via SIGTERM) while UE authentication is in progress, the teardown sequence frees pool-backed memory before clearing hash tables. The `ogs_hash_destroy()` function subsequently attempts to re-hash entry keys that reference the already-freed memory, leading to a 1-byte read of freed heap memory. This is a local-only vulnerability triggered during process exit, and while a PoC is available, the impact is limited to a minor information leak within the exit handler.
Affected products
- Open5GS Open5GS 2.7.7
Timeline
- 2026-06-09: advisory: GitHub Security Advisory published by maintainers
- 2026-07-09: disclosed: CVE published to NVD