PT-2022-21786 · Open5Gs · Open5Gs

Pablo Valle Alvear + 1 · Published 2022-09-28 · Updated 2022-09-30 · CVE-2022-3354

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open5GS versions up to 2.4.10

Description A vulnerability has been found in the library lib/core/ogs-tlv-msg.c of the component UDP Packet Handler, which can lead to denial of service. The manipulation affects unknown code. The exploit has been disclosed to the public and may be used.

Recommendations For Open5GS versions up to 2.4.10, it is recommended to apply a patch to fix this issue. As a temporary workaround, consider restricting access to the UDP Packet Handler component until a patch is available.

Exploit

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2022-3354

Affected Products

Open5Gs

References · 5

• 🔥 https://github.com/open5gs/open5gs/issues/1767 · Exploit
• https://osv.dev/vulnerability/CVE-2022-3354 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3354 · Security Note
• https://vuldb.com/?id.209686 · Note
• https://t.me/cibsecurity/50606 · Telegram Post