CVE-2022-39063
Published on: Not Yet Published
Last Modified on: 09/21/2022 02:27:00 PM UTC
Certain versions of Open5gs from Open5gs contain the following vulnerability:
When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Response. Once UPF receives a request, it gets the f_teid_len from incoming message, and then uses it to copy data from incoming message to struct f_teid without checking the maximum length. If the pdi.local_f_teid.len exceeds the maximum length of the struct of f_teid, the memcpy() overwrites the fields (e.g., f_teid_len) after f_teid in the pdr struct. After parsing the request, the UPF starts to build a response. The f_teid_len with its overwritten value is used as a length for memcpy(). A segmentation fault occurs, as a result of a memcpy(), if this overwritten value is large enough.
- CVE-2022-39063 has been assigned by
disclosu[email protected] to track the vulnerability - currently rated as HIGH severity. - Affected Vendor/Software: Open5GS - Open5GS version <2.4.9
CVSS3 Score: 7.5 - HIGH
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | LOW | NONE | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | NONE | NONE | HIGH |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| CyRC Vulnerability Advisory: Denial-of-service vulnerabilities (CVE-2022-39063) in Open5GS | Synopsys | www.synopsys.com text/html |
MISC www.synopsys.com/blogs/software-security/cyrc-advisory-open5gs/ |
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Open5gs | Open5gs | All | All | All | All |
- cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*:
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @buaqbot |
CyRC Vulnerability Advisory: Denial-of-service vulnerabilities (CVE-2022-39063) in Open5GS ift.tt/uvslyh0 ift.tt/9hZQmzX | 2022-09-14 14:21:37 |
| @cipherstorm |
CyRC Vulnerability Advisory: Denial-of-service vulnerabilities (CVE-2022-39063) in Open5GS: CVE-2022-39063 is a vul… twitter.com/i/web/status/1… | 2022-09-14 15:26:07 |
| @netsecu |
securityboulevard.com/2022/09/cyrc-v… CyRC Vulnerability Advisory: Denial-of-service vulnerabilities (CVE-2022-39063) in Open5GS #cybersecurity | 2022-09-14 16:04:13 |
| @filipe_f_silva |
CyRC Vulnerability Advisory: Denial-of-service vulnerabilities (CVE-2022-39063) in Open5GS securityboulevard.com/2022/09/cyrc-v… | 2022-09-14 16:15:10 |
| @Brent_Synopsys |
CyRC Vulnerability Advisory: Denial-of-service vulnerabilities (CVE-2022-39063) in Open5GS bit.ly/3BEK2UX | 2022-09-14 16:24:56 |
| @niane |
CyRC Vulnerability Advisory: Denial-of-service vulnerabilities (CVE-2022-39063) in Open5GS bit.ly/3BFFihQ | 2022-09-14 17:56:58 |
| @straussjesus |
CyRC Vulnerability Advisory: Denial-of-service vulnerabilities (CVE-2022-39063) in Open5GS bit.ly/3Dr6i6a | 2022-09-14 18:09:21 |
| @DavidJo07641320 |
CyRC Vulnerability Advisory: Denial-of-service vulnerabilities (CVE-2022-39063) in Open5GS bit.ly/3U5W6Wy | 2022-09-15 14:55:11 |
| @thenewstack |
CyRC Vulnerability Advisory: Denial-of-service vulnerabilities (CVE-2022-39063) in Open5GS synopsys.com/blogs/software… from @synopsys | 2022-09-15 20:34:00 |
| @CVEreport |
CVE-2022-39063 : When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for build… twitter.com/i/web/status/1… | 2022-09-16 19:07:50 |
| @Inceptus3 |
New Vulnerability: CVE-2022-39063 #InceptusSecure #UnderOurProtection | 2022-09-16 20:16:50 |
 /r/netcve |
CVE-2022-39063 | 2022-09-16 20:38:13 |