CVE-2021-41794: Buffer Overflow
ogsfqdnparse in Open5GS 1.0.0 through 2.3.3 inappropriately trusts a client-supplied length value, leading to a buffer overflow. The attacker can send a PFCP Session Establishment Request with "internet" as the PDI Network Instance. The first character is interpreted as a length value to be used in a memcpy call. The destination buffer is only 100 bytes long on the stack. Then, 'i' gets interpreted as 105 bytes to copy from the source buffer to the destination buffer.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-41794?
CVE-2021-41794 is a vulnerability in Open5GS which allows an attacker to perform a buffer overflow by sending a malicious PFCP Session Establishment Request.
What is the severity of CVE-2021-41794?
CVE-2021-41794 has a severity rating of 7.5, which is classified as high.
How does the vulnerability in Open5GS occur?
The vulnerability in Open5GS occurs due to the inappropriate trust of a client-supplied length value in the 'ogs_fqdn_parse' function, which leads to the buffer overflow.
What is the impact of CVE-2021-41794?
The impact of CVE-2021-41794 is that an attacker can exploit the buffer overflow to execute arbitrary code or crash the affected system.
Is there a fix for CVE-2021-41794?
Yes, updating Open5GS to versions 2.3.4 or later resolves the vulnerability.