Description

A security flaw has been discovered in Open5GS up to 2.7.x. Affected is the function amf_nnrf_try_old_amf_discovery_fallback of the file src/amf/nnrf-handler.c of the component Old AMF Discovery Fallback. The manipulation of the argument discovery_option results in use after free. The attack may be performed from remote. The patch is identified as ddd683a35f8aaac2b7b9884a24cd53bddfc65238. Applying a patch is advised to resolve this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-14T11:17:07.103Z",
  "pubdate": "2026-09-14T11:17:07.103Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in the Open5GS AMF (Access and Mobility Management Function) component, specifically within the nnrf-handler.c module. This flaw, discovered in versions up to 2.7.x, stems from improper handling of the 'discovery_option' argument during the 'amf_nnrf_try_old_amf_discovery_fallback' process. The vulnerability permits remote attackers to trigger memory corruption, which can lead to service disruption via application crashes or potential arbitrary code execution. Given the critical role of the AMF in 5G core network operations, this vulnerability poses a significant risk to network availability and system integrity. Exploitation does not necessarily require authenticated access, increasing the potential attack surface for remote actors capable of interacting with the NRF (Network Repository Function) discovery workflows.",
  "technicalDetails": "The vulnerability is classified as a use-after-free (UAF) condition located within the 'amf_nnrf_try_old_amf_discovery_fallback' function in the file 'src/amf/nnrf-handler.c'. The root cause resides in the mismanagement of object lifecycles related to the 'discovery_option' argument during the NRF discovery fallback procedure. In the Open5GS architecture, the AMF performs NRF discovery to locate peer network functions. When the fallback mechanism is triggered, the code fails to ensure that the memory associated with 'discovery_option' remains valid for the duration of the function's execution scope.\nThe attack flow initiates when a remote entity interacts with the AMF, triggering a specific sequence of discovery requests that force the application into the fallback logic path. During this execution, the software marks a memory region associated with 'discovery_option' for deallocation or frees it prematurely while subsequent logic still retains a pointer to that address. Because the pointer is not nullified after the initial free operation, a 'dangling pointer' is created. When the function attempts to access, read, or modify this memory location again—expecting the original data structure to remain intact—it accesses 'freed' memory. If the underlying memory allocator has repurposed this block for other tasks, the application processes corrupted data.\nSuccessful exploitation of this UAF can have severe consequences for the AMF process. If the attacker can control the contents of the memory after it is freed but before it is accessed (a process known as heap grooming or spraying), they may be able to manipulate the application's control flow or overwrite function pointers. At a minimum, this vulnerability leads to an immediate process crash, resulting in a Denial of Service (DoS) for all user equipment (UE) currently managed by that AMF instance. In more complex scenarios, the corruption of memory could be leveraged to achieve arbitrary code execution within the security context of the AMF process, potentially allowing an attacker to intercept signaling, modify network states, or pivot deeper into the 5G core network architecture.\nThe vulnerability affects Open5GS versions up to 2.7.x and is accessible remotely via network-facing interfaces that handle discovery requests. Since the NRF discovery process is a fundamental part of the 5G Service-Based Architecture (SBA), any exposure of the AMF interface to untrusted or compromised network peers represents a viable attack vector."
}