In the dynamic realm of 5G technology, ensuring robust security is paramount. At Vaan Megam Networks, we are dedicated to testing the security posture of 5G network infrastructure components, helping our clients protect 5G deployments from evolving threats.
Recently, our security research team identified and reported a critical vulnerability in Open5GS, culminating in the publication of CVE-2024-56921
Open5GS is a prominent open-source project that provides LTE and 5G mobile packet core network functionalities. Our team discovered a vulnerability in the Access and Mobility Management Function (AMF) in version 2.7.2.
AMF is crashed when sending a multiple Initial UE Registration request for the same UE due to incorrect error handling in the gmm_state_exception() function upon receiving the Nausf UEAuthentication Authenticate response.
For a detailed technical discussion, please refer to the official GitHub issue: Open5GS Issue #3608.
An attacker can exploit this vulnerability by sending a UE registration request for the same UE multiple times in a short period.
State inconsistency due to frequent changes in the mobility management state leads to a segmentation fault, causing the AMF to crash and resulting in a denial-of-service (DoS) condition for the network.
The vulnerability affects Open5GS versions 2.7.2 and earlier. Users operating these versions are at risk and should take immediate action to mitigate potential threats.
To address this vulnerability, we recommend an Upgrade to Open5GS commit f780f9a or later. The vulnerability was patched as of commit f780f9a on December 2, 2024.
📌 Read more about CVE-2024-56921: CVE Official Page
📌 Technical Discussion: GitHub Issue #3608
We are a leading provider of 5G-based services including lab-as-a-service and test-as-a-service for enterprises, telcos, and system integrators. Our services accelerate your solution deployment and ensure new products and services meet real-world customer requirements.
For inquiries, contact us at contact@vaanmegam.net
⭐Disclaimer:This audio was generated using Google AI and is for informational purposes only. Views expressed do not reflect our company's stance