CVE-2024-57519
📋 TL;DR
A denial-of-service vulnerability in Open5GS v2.7.2 allows remote attackers to crash the service via the ogs_dbi_auth_info function. This affects all systems running vulnerable versions of Open5GS, particularly those exposed to untrusted networks. The vulnerability stems from improper resource handling in the subscription database interface.
💻 Affected Systems
- Open5GS
📦 What is this software?
Open5gs by Open5gs
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of Open5GS components, affecting mobile network core functionality and causing widespread service unavailability.
Likely Case
Targeted DoS attacks causing intermittent service outages and degraded performance for affected mobile network services.
If Mitigated
Limited impact with proper network segmentation and monitoring, potentially causing only temporary service interruptions.
🎯 Exploit Status
The vulnerability requires crafting specific requests to trigger the resource exhaustion condition.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 08b9e7c55f72649ef25b5407e7e4d938f0f16531 and later versions
Vendor Advisory: https://github.com/open5gs/open5gs/issues/3635
Restart Required: Yes
Instructions:
1. Update Open5GS to latest version or apply commit 08b9e7c55f72649ef25b5407e7e4d938f0f16531
2. Rebuild Open5GS from source
3. Restart all Open5GS services
4. Verify the fix is applied
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to Open5GS components to trusted networks only
iptables -A INPUT -p tcp --dport [Open5GS ports] -s [trusted networks] -j ACCEPT
iptables -A INPUT -p tcp --dport [Open5GS ports] -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to trusted sources only
- Deploy rate limiting and monitoring for abnormal request patterns to Open5GS services
🔍 How to Verify
Check if Vulnerable:
Check Open5GS version: open5gs --version and verify if it's v2.7.2 or earlierCheck Version:
open5gs --versionVerify Fix Applied:
Verify the commit hash includes 08b9e7c55f72649ef25b5407e7e4d938f0f16531 or later, and test with crafted requests that previously caused crashes📡 Detection & Monitoring
Log Indicators:
- Repeated crashes or restarts of Open5GS processes
- Error messages related to ogs_dbi_auth_info or subscription.c
- Abnormal memory usage patterns
Network Indicators:
- Unusual traffic patterns to Open5GS subscription endpoints
- High volume of malformed requests to vulnerable ports
SIEM Query:
source="open5gs.log" AND ("ogs_dbi_auth_info" OR "subscription.c" OR "segmentation fault")