Executive brief
Open5GS is an open-source implementation of a 5G core network that processes telecommunications signaling protocols. A vulnerability in its PFCP (Packet Forwarding Control Protocol) parser can cause a service crash when processing malformed network packets, disrupting mobile network operations and affecting all connected devices.
Technical details
The vulnerability is a null pointer dereference in the PFCP packet parser, specifically in the ogs_pfcp_parse_volume_measurement() function within lib/pfcp/types.c. The parser reads flag octets and 8-octet fields without validating the declared IE (Information Element) length, allowing reads up to 48 octets past the end of a malformed IE. Additionally, SMF usage report handlers call this function without checking the volume_measurement.presence field, leading to NULL dereference on absent IEs. An attacker on the network can send a crafted PFCP packet with truncated or malformed Information Elements to trigger the crash. The patch (commit 8f07b507b78ff94776f2cd49276eb116ed93d7f2) adds bounds checks to validate octet length before parsing.
Affected products
- Open5GS Open5GS up to 2.8.0
Timeline
- 2026-09-16: disclosed
- 2026-09-10: patched: Patch commit 8f07b507b78ff94776f2cd49276eb116ed93d7f2 applied