CVE-2021-44108
📋 TL;DR
This vulnerability in Open5GS allows remote attackers to cause a Denial of Service (DoS) by sending a specially crafted SBI request to the AMF component. The null pointer dereference causes the AMF service to crash, disrupting 5G network functionality. Any organization running vulnerable versions of Open5GS with AMF exposed to untrusted networks is affected.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of 5G network services served by the affected AMF instance, potentially affecting multiple user devices and network functions.
Likely Case
AMF service crash requiring manual restart, causing temporary service disruption for connected devices.
If Mitigated
Limited impact with proper network segmentation and monitoring allowing quick detection and recovery.
🎯 Exploit Status
The vulnerability requires sending a crafted SBI request to the AMF interface, which is typically network-accessible. No authentication is required to trigger the null pointer dereference.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.7 and later
Vendor Advisory: https://github.com/open5gs/open5gs/commit/d919b2744cd05abae043490f0a3dd1946c1ccb8c
Restart Required: Yes
Instructions:
1. Update Open5GS to version 2.3.7 or later. 2. Apply the patch from commit d919b2744cd05abae043490f0a3dd1946c1ccb8c. 3. Restart the AMF service. 4. Verify the fix by checking the version and monitoring for crashes.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict network access to AMF SBI interface to trusted networks only
iptables -A INPUT -p tcp --dport [AMF_PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [AMF_PORT] -j DROP
Rate Limiting
linuxImplement rate limiting on AMF SBI interface to limit impact of DoS attempts
iptables -A INPUT -p tcp --dport [AMF_PORT] -m limit --limit 10/minute --limit-burst 20 -j ACCEPT
🧯 If You Can't Patch
- Implement strict network access controls to limit AMF SBI interface exposure
- Deploy monitoring and alerting for AMF service crashes with automated restart capabilities
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs-amfd --version. If version is 2.3.6 or earlier, the system is vulnerable.Check Version:
open5gs-amfd --versionVerify Fix Applied:
After patching, verify version is 2.3.7 or later and monitor AMF service for stability. Test with normal SBI requests.📡 Detection & Monitoring
Log Indicators:
- AMF service crash logs
- Segmentation fault errors in system logs
- Unexpected AMF process termination
Network Indicators:
- Unusual SBI request patterns to AMF port
- Multiple connection attempts to AMF from single source
SIEM Query:
source="*amf*" AND ("segmentation fault" OR "null pointer" OR "crash" OR "terminated unexpectedly")