CVE-2023-4883: Multiple vulnerabilities in Open5GS

Q: What is CVE-2023-4883?

CVE-2023-4883 is an invalid pointer release vulnerability that could allow an attacker to interrupt the correct operation of the service.

Q: How can an attacker exploit CVE-2023-4883?

An attacker can exploit CVE-2023-4883 by sending a specially crafted json string to the VNF (Virtual Network Function) and triggering the ogs_sbi_message_free function.

Q: What is the severity of CVE-2023-4883?

CVE-2023-4883 has a severity value of 7.5, which is considered high.

Q: Which software is affected by CVE-2023-4883?

Open5gs version up to and including 2.4.10 is affected by CVE-2023-4883.

Q: How can I mitigate the vulnerability CVE-2023-4883?

To mitigate the CVE-2023-4883 vulnerability, it is recommended to update Open5gs to a version higher than 2.4.10.

Published Oct 3, 2023

Updated

Invalid pointer release vulnerability. Exploitation of this vulnerability could allow an attacker to interrupt the correct operation of the service by sending a specially crafted json string to the VNF (Virtual Network Function), and triggering the ogssbimessagefree function, which could cause a service outage.

Affected Software

1 affected component

open5gs open5gs<=2.4.10

Remediation

Information

Open5GS is working on a fix for the reported vulnerabilities.

Event History

Oct 3, 2023

CVE Published

via MITRE·02:42 PM

Data Sourced

via MITRE·02:42 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2023-4883?

CVE-2023-4883 is an invalid pointer release vulnerability that could allow an attacker to interrupt the correct operation of the service.

How can an attacker exploit CVE-2023-4883?