CVE-2022-39063 Memory corruption in Open5GS
A remote attacker can cause a segmentation fault and denial of service in Open5GS UPF by sending a crafted PFCP Session Establishment Request with an oversized length field.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-39063?
CVE-2022-39063 is a high-severity memory corruption vulnerability in Open5gs Open5gs, published on 16 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Response. Once UPF receives a request, it gets the f_teid_len from incoming message, and then uses it to copy data from incoming message to struct f_teid without checking the maximum length. If the pdi.local_f_teid.len exceeds the maximum length of the struct of f_teid, the memcpy() overwrites the fields (e.g., f_teid_len) after f_teid in the pdr struct. After parsing the request, the UPF starts to build a response. The f_teid_len with its overwritten value is used as a length for memcpy(). A segmentation fault occurs, as a result of a memcpy(), if this overwritten value is large enough.
Weakness: CWE-676
Which versions are affected by CVE-2022-39063?
It affects 1 product.
Products include Open5gs Open5gs.
How do I fix CVE-2022-39063?
No fix has been published for CVE-2022-39063 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-39063 being exploited?
There is no known exploitation of CVE-2022-39063 in the wild and no public exploit code.
Other vulnerabilities in Open5gs Open5gs
Sources
Also known as GHSA-963g-g6x3-46cf.