CVE-2021-41794 - CVE House
Back to Database
Status published High CVE-2021-41794

ogs_fqdn_parse in Open5GS 1.0.0 through 2.3.3 inappropriately trusts a client-supplied...

Vulnerability Description

ogs_fqdn_parse in Open5GS 1.0.0 through 2.3.3 inappropriately trusts a client-supplied length value, leading to a buffer overflow. The attacker can send a PFCP Session Establishment Request with "internet" as the PDI Network Instance. The first character is interpreted as a length value to be used in a memcpy call. The destination buffer is only 100 bytes long on the stack. Then, 'i' gets interpreted as 105 bytes to copy from the source buffer to the destination buffer.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-41794

Credits & Attribution

No credits recorded in the NVD database.

References

More from open5gs

View All →
CVE-2022-43223
open5gs v2.4.11 was discovered to contain a memory leak in...
Unknown 0
CVE-2022-43222
open5gs v2.4.11 was discovered to contain a memory leak in...
Unknown 0
CVE-2022-43221
open5gs v2.4.11 was discovered to contain a memory leak in...
Unknown 0
CVE-2022-40890
A vulnerability in /src/amf/amf-context.c in Open5GS 2.4.10 and earlier leads...
Unknown 0
CVE-2021-45462
In Open5GS 2.4.0, a crafted packet from UE can crash...
High 7.5

Affected Vendor

Affected Software

open5gs
Vulnerable Versions:
1.0.0

Timeline

Official Publish: October 7th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.