Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser

Summary

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.

Remediation

1. Inventory every open5gs open5gs deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Patchhttps://github.com/open5gs/open5gs/commit/6820c2743b5b5e126e3755d2f92dae2b236732df
• Advisoryhttps://github.com/open5gs/open5gs/security/advisories/GHSA-25v2-v588-jq8g
• Advisoryhttps://www.vulncheck.com/advisories/open5gs-1.3.0-through-2.8.0-heap-out-of-bounds-write-via-sbi-multipart-parser
• Referencehttps://github.com/open5gs/open5gs
• Referencehttps://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/contrib/multipart_parser.c#L260
• Referencehttps://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/message.c#L3372