free5GC vulnerable to malformed NGAP message crashing the AMF and NGAP decoders · CVE-2022-43677 · GitHub Advisory Database · GitHub

free5GC vulnerable to malformed NGAP message crashing the AMF and NGAP decoders

Moderate severity GitHub Reviewed Published Oct 24, 2022 to the GitHub Advisory Database • Updated Jan 23, 2024

Package

github.com/free5gc/free5gc (Go)

Affected versions

<= 3.2.1

Patched versions

None

Description

In free5GC 3.2.1, a malformed NGAP message can crash the AMF and NGAP decoders via an index-out-of-range panic in aper.GetBitString.

References

Published by the National Vulnerability Database

Oct 24, 2022

Published to the GitHub Advisory Database Oct 24, 2022

Reviewed Oct 25, 2022

Last updated Jan 23, 2024

Severity

Moderate

5.5

/ 10

CVSS base metrics

Attack vector

Local

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H