Description

A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smf_nudm_sdm_handle_get of the file src/smf/nudm-handler.c of the component SMF. Executing a manipulation of the argument preemptCap can lead to reachable assertion. The attack may be launched remotely. Upgrading to version 2.8.0 is sufficient to fix this issue. This patch is called 4554405f29bffd7562abedbee63484825bd90cd5. You should upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-30T23:17:07.967Z",
  "pubdate": "2026-08-30T23:17:07.967Z",
  "executiveSummary": "A reachable assertion vulnerability exists in the Session Management Function (SMF) component of Open5GS, affecting versions up to 2.7.7.\nThe vulnerability originates from improper handling of the 'preemptCap' argument within the 'smf_nudm_sdm_handle_get' function located in 'src/smf/nudm-handler.c'.\nAn unauthenticated remote attacker can trigger this vulnerability by submitting a maliciously crafted input, leading to a process crash due to an assertion failure.\nThis flaw results in a Denial of Service (DoS) condition, disrupting session management capabilities within the 5G core network architecture.\nThe attack vector is remote, necessitating no prior authentication, and exploitation depends on the ability to interact with the SMF's Nudm-SDM interface.\nOrganizations relying on Open5GS are at risk of service outages if exposed to untrusted network segments.",
  "technicalDetails": "The vulnerability is situated within the SMF's Nudm-SDM (Subscription Data Management) handler logic. Specifically, the function 'smf_nudm_sdm_handle_get' in 'src/smf/nudm-handler.c' contains an assertion that validates the integrity or structure of incoming data structures related to the 'preemptCap' (Preemption Capability) field.\nThe root cause is an insecure validation mechanism where the SMF process assumes certain input parameters provided during the Nudm-SDM transaction will conform to strict expectations. When an attacker supplies a manipulated 'preemptCap' argument that fails these expectations, the code triggers a hard assertion failure.\nIn the context of the C programming language and the Open5GS framework, reaching an assertion failure results in an immediate invocation of the abort() function. This causes the SMF process to terminate abruptly to prevent memory corruption or undefined state transitions.\nThe attack flow follows these steps: 1. The attacker identifies the Nudm-SDM service interface exposed by the SMF. 2. The attacker constructs a malformed Nudm-SDM request containing a manipulated 'preemptCap' field. 3. The attacker transmits this packet to the SMF over the network. 4. Upon reception, the 'smf_nudm_sdm_handle_get' function parses the payload and attempts to process the 'preemptCap' argument. 5. The assertion check evaluates the invalid input, fails, and forces the SMF process to exit.\nBecause the SMF is a critical component for session establishment, modification, and termination in a 5G core network, an attacker can effectively disable network connectivity for UEs (User Equipment) attached through the affected SMF. This is a classic Denial of Service attack against a control plane element.\nThe vulnerability affects all Open5GS versions up to 2.7.7. The flaw is addressed by the official patch identified as '4554405f29bffd7562abedbee63484825bd90cd5', which introduces robust input validation and safer handling of the 'preemptCap' argument to prevent the trigger of the assertion failure. Version 2.8.0 incorporates this fix and is the recommended baseline for remediation."
}