CVE-2021-44081
📋 TL;DR
A buffer overflow vulnerability in open5gs AMF component allows attackers to cause denial of service by sending specially crafted Supi messages with MSIN exceeding 24 characters. This affects open5gs deployments using vulnerable versions, potentially disrupting 5G core network functions.
💻 Affected Systems
- open5gs
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete AMF service disruption leading to 5G network unavailability for affected subscribers, potentially cascading to other network functions.
Likely Case
AMF process crash causing temporary service interruption for subscribers, requiring service restart.
If Mitigated
Controlled restart of AMF service with minimal subscriber impact if monitoring and redundancy are in place.
🎯 Exploit Status
Exploitation requires network access to AMF interface. The vulnerability is straightforward to trigger with malformed input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.5 or later
Vendor Advisory: https://github.com/open5gs/open5gs/issues/1206
Restart Required: Yes
Instructions:
1. Update open5gs to version 2.1.5 or later. 2. Stop AMF service. 3. Install updated version. 4. Restart AMF service. 5. Verify service functionality.
🔧 Temporary Workarounds
Input validation at network perimeter
allImplement packet inspection to filter Supi messages with MSIN exceeding 24 characters
Rate limiting and monitoring
linuxImplement rate limiting on AMF interface and monitor for abnormal Supi message patterns
🧯 If You Can't Patch
- Implement network segmentation to restrict access to AMF interface
- Deploy redundant AMF instances with load balancing to maintain service during disruptions
🔍 How to Verify
Check if Vulnerable:
Check open5gs version: open5gs-amfd --version. If version is 2.1.4 or earlier, system is vulnerable.Check Version:
open5gs-amfd --versionVerify Fix Applied:
After patching, verify version is 2.1.5 or later and test with valid Supi messages of varying lengths.📡 Detection & Monitoring
Log Indicators:
- AMF process crashes
- Abnormal termination logs
- Supi messages with MSIN length > 24 characters in debug logs
Network Indicators:
- Sudden drop in AMF service availability
- Increased error responses from AMF
SIEM Query:
source="open5gs" AND ("AMF crash" OR "buffer overflow" OR "Supi length")