CVE-2024-57519
Published: 28 January 2025
Description
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Security Summary
CVE-2024-57519 is a denial-of-service vulnerability affecting Open5GS version 2.7.2, an open-source implementation of a 5G core network. The flaw resides in the ogs_dbi_auth_info function within the lib/dbi/subscription.c file, where improper handling allows resource exhaustion. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-400 (Uncontrolled Resource Consumption).
A remote attacker with network access can exploit this vulnerability without authentication or user interaction by sending crafted requests that trigger the faulty function, leading to excessive resource usage and service disruption. Successful exploitation results in high-impact availability loss for the affected Open5GS component, potentially halting core network functions like subscriber authentication.
Mitigation is available via a patch in Open5GS commit 08b9e7c55f72649ef25b5407e7e4d938f0f16531, which addresses the issue in the subscription database interface. Additional details are documented in the Open5GS GitHub issue #3635 and a vulnerability research repository at github.com/f4rs1ght/vuln-research/tree/main/CVE-2024-57519, recommending immediate upgrades for deployments running the vulnerable version.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
CVE-2024-57519 enables remote denial of service via crafted input to the ogs_dbi_auth_info function in Open5GS, a network service, by exploiting the application to crash or exhaust it (T1499.004).