PT-2022-21624 · Open5Gs · Open5Gs

Pablo Valle Alvear + 1 · Published 2022-09-26 · Updated 2022-10-03 · CVE-2022-3299

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open5GS versions up to 2.4.10

Description A vulnerability was found in the library lib/sbi/client.c of the component AMF, affecting an unknown functionality. The manipulation leads to denial of service. The attack can be launched remotely.

Recommendations For Open5GS versions up to 2.4.10, it is recommended to apply a patch to fix this issue. The patch with the name 724fa568435dae45ef0c3a48b2aabde052afae88 should be applied. As a temporary workaround, consider restricting access to the vulnerable component AMF until a patch is available.

Exploit

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2022-3299

Affected Products

Open5Gs

References · 7

• 🔥 https://github.com/open5gs/open5gs/issues/1769 · Exploit
• https://github.com/open5gs/open5gs/commit/724fa568435dae45ef0c3a48b2aabde052afae88 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-3299 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3299 · Vendor Advisory
• https://vuldb.com/?id.209545 · Note
• https://t.me/cvenotify/36824 · Telegram Post
• https://t.me/cibsecurity/50482 · Telegram Post