CVE-2024-40129

The vulnerability consists of writing data outside the boundaries of an allocated buffer on the heap (heap-based buffer overflow, CWE-122), which occurs in the PFCP protocol context handling module (Packet Forwarding Control Protocol). An attacker can provide crafted network data that causes writing outside the permitted memory area. The attack vector is network-based, requires no authentication or user interaction, which significantly increases the risk.

An attacker can gain full control over the vulnerable process, execute arbitrary code (RCE), or cause service failure (DoS). System confidentiality, integrity, and availability are at risk.

Patches available from the vendor must be applied according to references — fix available in the Open5GS GitHub repository as commit 2fbc445d32aa7749166396a9c055a199f90a1b01. Update to a version containing the indicated commit is recommended.

Open5GS version 2.6.4