ogs_fqdn_parse in Open5GS 1.0.0 up to and including 2.3.3 inappropriately trusts a client-supplied length value, leading to a buffer overflow. The attacker can send a PFCP Session Establishment Request with "internet" as the PDI Network Instance. The first character is interpreted as a length value to be used in a memcpy call. The destination buffer is only 100 bytes long on the stack. Then, 'i' gets interpreted as 105 bytes to copy from the source buffer to the destination buffer.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
open5gs open5gs |
Vulmon