PT-2022-24601 · Free5Gc · Free5Gc

P1-Bmuo · Published 2022-11-18 · Updated 2022-11-24 · CVE-2022-38871

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Free5gc version 3.0.5

Description The issue arises due to malformed NAS messages, causing the AMF to break.

Recommendations For Free5gc version 3.0.5, consider implementing input validation to handle malformed NAS messages properly until a patch is available.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2022-38871

GHSA-M74X-FXJH-3QH9

Affected Products

Free5Gc

References · 6

• 🔥 https://github.com/free5gc/free5gc/issues/198 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-38871 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38871 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m74x-fxjh-3qh9 · Vendor Advisory
• https://github.com/free5gc/free5gc · Note
• https://t.me/cibsecurity/53193 · Telegram Post