Description
Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
open5gs open5gs
Default version status: unaffected
1.3.0 to ≤ 2.8.0affected
References
- https://github.com/open5gs/open5gs/security/advisories/GHSA-25v2-v588-jq8g ↗
- https://github.com/open5gs/open5gs/commit/6820c2743b5b5e126e3755d2f92dae2b236732df ↗
- https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/message.c#L3372 ↗
- https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/contrib/multipart_parser.c#L260 ↗
- https://github.com/open5gs/open5gs ↗
- https://www.vulncheck.com/advisories/open5gs-1.3.0-through-2.8.0-heap-out-of-bounds-write-via-sbi-multipart-parser ↗