CVE-2021-41794
📋 TL;DR
This vulnerability in Open5GS allows remote attackers to execute arbitrary code or cause denial of service via a buffer overflow. Attackers can exploit it by sending a specially crafted PFCP Session Establishment Request with 'internet' as the PDI Network Instance. Systems running vulnerable versions of Open5GS UPF (User Plane Function) are affected.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or lateral movement within the network.
Likely Case
Denial of service causing UPF functionality disruption, potentially affecting mobile network services.
If Mitigated
Limited impact if proper network segmentation and access controls prevent exploitation attempts.
🎯 Exploit Status
The vulnerability requires sending a malformed PFCP packet but doesn't require authentication. Public technical details and proof-of-concept information are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.4 and later
Vendor Advisory: https://github.com/open5gs/open5gs/security/advisories/GHSA-5q4x-4q2h-5q4x
Restart Required: Yes
Instructions:
1. Update Open5GS to version 2.3.4 or later. 2. Stop the UPF service. 3. Apply the update. 4. Restart the UPF service. 5. Verify the service is running correctly.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict network access to the PFCP interface (port 8805 by default) to only trusted systems.
iptables -A INPUT -p udp --dport 8805 -s trusted_ip_range -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the UPF from untrusted networks
- Deploy intrusion detection/prevention systems to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-upfd --version. If version is between 1.0.0 and 2.3.3 inclusive, the system is vulnerable.Check Version:
open5gs-upfd --versionVerify Fix Applied:
After patching, verify version is 2.3.4 or later and test PFCP session establishment functionality.📡 Detection & Monitoring
Log Indicators:
- PFCP Session Establishment Request failures
- UPF process crashes or abnormal terminations
- Memory access violation errors in system logs
Network Indicators:
- PFCP packets with 'internet' as PDI Network Instance
- Unusual traffic patterns to port 8805
- Malformed PFCP packets exceeding normal size limits
SIEM Query:
source="open5gs.logs" AND ("PFCP Session Establishment" OR "internet" OR "buffer overflow")