Affected Version: UERANSIM ≤ 3.3.0
Vendor: UERANSIM
Vulnerability Files:
src/lib/nas/encode.cppThe vulnerability is caused using a series of RLS message, which includes one RLS heartbeat message, RRC setup request message and RRC setup complete message. The malformed RRC Setup complete meessage carries an unknown NAS message type which causes an uncaught exception in DecodePlainMmMessage() function and crashes the nr-gnb.
Affected Version: UERANSIM ≤ 3.3.0
Vendor: UERANSIM
Vulnerability Files:
src/gnb/rrc/handler.cppThe vulnerability is caused using a series of RLS message, which includes one RLS heartbeat message and one ULInformationTransfer message. The malformed ULInformationTransfer meessage is decoded as the dedicatedNAS_Message set to NULL and the receiveUplinkInformationTransfer function dereferences it without a NULL check, crashing the gNB with a SIGSEGV. The attacker can launch a remote attack using this RLS message sequence and cause Denial-of-Service of nr-gnb.
Affected Version: UERANSIM ≤ 3.3.0
Vendor: UERANSIM
Vulnerability Files:
src/lib/rls/rls_pdu.cppThe RLS decoding layer of nr-gnb lacks a non-empty check (in DecodeRlsMessage function in rls_pdu.cpp), it only verifies that pduLength <= 16384 and remainingSize > 0. As a result, it accepts the message and produces an empty OctetString of length 0. The upper GTP Layer performs a read at address 0x0, resulting in a SIGSEGV(signal 11).The attacker can launch a remote Denial-of-Service attack to nr-gnb using malformed RLS message.
Open5GS AMF Heap Buffer Overflow in ogs_nas_5gs_decode_gprs_timer_2()
| Field | Value |
|---|---|
| Product Name | Open5GS |
| Component | AMF (Access and Mobility Management Function) |
| Affected File | lib/nas/5gs/ies.c, lib/nas/5gs/decoder.c |
| Function | ogs_nas_5gs_decode_gprs_timer_2(), ogs_nas_5gs_decode_service_accept() |