Open5GS Memory and Authorization Flaws

Improper authorization in Open5GS 2.8.0's AMF UEContextReleaseRequest path handler allows remote low-privileged attackers to trigger unauthorized UE context release operations in the 5G core network. The flaw, tagged as an authentication bypass (CWE-285), affects the Access and Mobility Management Function - a security-critical component governing device connectivity and session management in 5G deployments. A proof-of-concept exploit exists (E:P in CVSS 4.0 supplemental), and no CISA KEV listing was identified at time of analysis.

Out-of-bounds read in Open5GS 2.8.0 PCRF Rx AA-Request handler allows remote low-privileged attackers with Diameter Rx interface access to send crafted AA-Request messages containing null or incorrectly-sized Framed-IP-Address or Framed-IPv6-Prefix AVPs, triggering memory reads beyond allocated boundaries. The patch commit c18dc6938bf63cc7374315d3dca303d92066e746 adds missing null and length validation for both AVP types; a tagged release incorporating it has not been independently confirmed. No active exploitation is recorded in CISA KEV, though the CVSS 4.0 E:P flag indicates proof-of-concept code is known to exist.

Heap-based buffer overflow in Open5GS 2.8.0's HSS S6a Authentication-Information-Request handler allows network-adjacent authenticated Diameter peers to corrupt process heap memory by supplying a malformed Visited-PLMN-Id AVP with an incorrect octet-string length. The vulnerable function `hss_ogs_diam_s6a_air_cb` in `src/hss/hss-s6a-path.c` passes raw AVP data to cryptographic key derivation (`ogs_auc_kasme`) without first validating that the PLMN identifier length matches the expected 3-byte constant `OGS_PLMN_ID_LEN`. No active exploitation is confirmed (no CISA KEV listing), but a proof-of-concept signal is present in the CVSS 4.0 threat metric (E:P); an upstream fix commit is available though a formally tagged patched release is not independently confirmed.