CVE-2022-39063

When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Response. Once UPF receives a request, it gets the f_teid_len from incoming message, and then uses it to copy data from incoming message to struct f_teid without checking the maximum length. If the pdi.local_f_teid.len exceeds the maximum length of the struct of f_teid, the memcpy() overwrites the fields (e.g., f_teid_len) after f_teid in the pdr struct. After parsing the request, the UPF starts to build a response. The f_teid_len with its overwritten value is used as a length for memcpy(). A segmentation fault occurs, as a result of a memcpy(), if this overwritten value is large enough.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.synopsys.com/blogs/software-security/cyrc-advisory-open5gs/	Exploit Third Party Advisory
https://www.synopsys.com/blogs/software-security/cyrc-advisory-open5gs/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:17

Type	Values Removed	Values Added
References	~~() https://www.synopsys.com/blogs/software-security/cyrc-advisory-open5gs/ - Exploit, Third Party Advisory~~	() https://www.synopsys.com/blogs/software-security/cyrc-advisory-open5gs/ - Exploit, Third Party Advisory

Information

Published : 2022-09-16 19:15

Updated : 2024-11-21 07:17

NVD link : CVE-2022-39063

Mitre link : CVE-2022-39063

CVE.ORG link : CVE-2022-39063

JSON object : View

Products Affected

open5gs

open5gs

CWE

CWE-676

Use of Potentially Dangerous Function

NVD-CWE-noinfo

{"id": "CVE-2022-39063", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-09-16T19:15:10.030", "references": [{"url": "https://www.synopsys.com/blogs/software-security/cyrc-advisory-open5gs/", "tags": ["Exploit", "Third Party Advisory"], "source": "disclosure@synopsys.com"}, {"url": "https://www.synopsys.com/blogs/software-security/cyrc-advisory-open5gs/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "disclosure@synopsys.com", "description": [{"lang": "en", "value": "CWE-676"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Response. Once UPF receives a request, it gets the f_teid_len from incoming message, and then uses it to copy data from incoming message to struct f_teid without checking the maximum length. If the pdi.local_f_teid.len exceeds the maximum length of the struct of f_teid, the memcpy() overwrites the fields (e.g., f_teid_len) after f_teid in the pdr struct. After parsing the request, the UPF starts to build a response. The f_teid_len with its overwritten value is used as a length for memcpy(). A segmentation fault occurs, as a result of a memcpy(), if this overwritten value is large enough."}, {"lang": "es", "value": "Cuando Open5GS UPF recibe una petici\u00f3n de establecimiento de sesi\u00f3n PFCP, almacena los valores relacionados para construir la respuesta de establecimiento de sesi\u00f3n PFCP. Una vez que UPF recibe una petici\u00f3n, obtiene el f_teid_len del mensaje entrante, y luego lo usa para copiar los datos del mensaje entrante a la estructura f_teid sin comprobar la longitud m\u00e1xima. Si pdi.local_f_teid.len supera la longitud m\u00e1xima de la struct de f_teid, memcpy() sobrescribe los campos (por ejemplo, f_teid_len) despu\u00e9s de f_teid en la struct de pdr. Despu\u00e9s de analizar la petici\u00f3n, la UPF comienza a construir una respuesta. El f_teid_len con su valor sobrescrito es usado como longitud para memcpy(). Es producido un fallo de segmentaci\u00f3n, como resultado de una memcpy(), si este valor sobrescrito es lo suficientemente grande"}], "lastModified": "2024-11-21T07:17:28.977", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9B26E94-388C-44FD-ABE2-E2DFBF3BD1C3", "versionEndIncluding": "2.4.9"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@synopsys.com"}