CVE-2022-39063

{"id": "CVE-2022-39063", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-09-16T19:15:10.030", "references": [{"url": "https://www.synopsys.com/blogs/software-security/cyrc-advisory-open5gs/", "tags": ["Exploit", "Third Party Advisory"], "source": "disclosure@synopsys.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "disclosure@synopsys.com", "description": [{"lang": "en", "value": "CWE-676"}]}], "descriptions": [{"lang": "en", "value": "When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Response. Once UPF receives a request, it gets the f_teid_len from incoming message, and then uses it to copy data from incoming message to struct f_teid without checking the maximum length. If the pdi.local_f_teid.len exceeds the maximum length of the struct of f_teid, the memcpy() overwrites the fields (e.g., f_teid_len) after f_teid in the pdr struct. After parsing the request, the UPF starts to build a response. The f_teid_len with its overwritten value is used as a length for memcpy(). A segmentation fault occurs, as a result of a memcpy(), if this overwritten value is large enough."}, {"lang": "es", "value": "Cuando Open5GS UPF recibe una petici\u00f3n de establecimiento de sesi\u00f3n PFCP, almacena los valores relacionados para construir la respuesta de establecimiento de sesi\u00f3n PFCP. Una vez que UPF recibe una petici\u00f3n, obtiene el f_teid_len del mensaje entrante, y luego lo usa para copiar los datos del mensaje entrante a la estructura f_teid sin comprobar la longitud m\u00e1xima. Si pdi.local_f_teid.len supera la longitud m\u00e1xima de la struct de f_teid, memcpy() sobrescribe los campos (por ejemplo, f_teid_len) despu\u00e9s de f_teid en la struct de pdr. Despu\u00e9s de analizar la petici\u00f3n, la UPF comienza a construir una respuesta. El f_teid_len con su valor sobrescrito es usado como longitud para memcpy(). Es producido un fallo de segmentaci\u00f3n, como resultado de una memcpy(), si este valor sobrescrito es lo suficientemente grande"}], "lastModified": "2022-09-21T14:27:32.553", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9B26E94-388C-44FD-ABE2-E2DFBF3BD1C3", "versionEndIncluding": "2.4.9"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@synopsys.com"}