OpenAirInterface CN5G AMF NAS decoder integer underflow causes service crash
A server that manages 5G network access can be stopped by special requests.
Summary
The NAS decoder in OpenAirInterface (OAI) CN5G AMF v2.2.1 does not check the length of a truncated SUCI in registration requests, so the AMF process crashes. An unauthenticated remote attacker can stop the service.
What to do
We have not confirmed a fixed version yet. Check the source links below.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen