Open5GS AMF Memory Leak (CWE-401) in ngap_send_to_nas: Analysis and Exploitation

Vulnerability Overview A memory leak vulnerability exists in the function of the Open5GS AMF. When the AMF receives a NAS PDU with an unrecognized or invalid NAS security header type, the function allocates a packet buffer ( ) but fails to free it before returning an error code ( ). Since the registration request is the first message in the NR registration procedure and lacks security protection, it is susceptible to malicious exploitation. Affected Scope Product: Open5GS Component: AMF (Access and Mobility Management Function) Affected File: Function: Version: Up to v2.7.7 Vulnerability Type: CWE-401: Missing Release of Memory after Effective Lifetime Remediation The fix is not explicitly mentioned on the page, but based on the vulnerability description, the remediation should involve freeing the allocated buffer before returning the error code. POC Code Attack Scenario 1. The attacker establishes a connection with the AMF via an SCTP association with network access privileges. 2. Sends an NGAP InitialUEMessage containing a NAS PDU with an invalid security header type (e.g., 0x09, which is not one of the five defined security header types). 3. The AMF allocates a packet buffer, hits the case in the statement, and returns without freeing the buffer. 4. Repeat this process to gradually exhaust the AMF's memory. Verification Confirmed The memory leak was confirmed using AddressSanitizer (ASAN). Proof of Concept Any value other than 0x00 to 0x04 triggers the branch, resulting in a memory leak. We used a modified srUE and sent the hex stream as the start of the NAS PDU for the Registration Request to trigger the default branch. References Open5GS GitHub Repository: https://github.com/open5gs/open5gs srSRAN Project: https://docs.srsran.com/projects/project/en/latest/tutorials/source/srUE/source/index.html

Goal Reached Thanks to every supporter — we hit 100%!

Open5GS AMF Memory Leak (CWE-401) in ngap_send_to_nas: Analysis and Exploitation

More from this source