CVE-2024-14042: Open5GS Buffer Overflow Vulnerability

CVE-2024-14042 Overview

CVE-2024-14042 is a stack-based buffer overflow vulnerability affecting Open5GS versions up to 2.7.1. The flaw resides in the hss_ogs_diam_s6a_air_cb and hss_ogs_diam_s6a_ulr_cb functions within src/hss/hss-s6a-path.c, part of the Diameter S6a interface used by the Home Subscriber Server (HSS). Attackers can trigger the overflow by manipulating the os.len argument in a crafted Diameter message. The issue is tracked under [CWE-119] and is remotely reachable across the network. A public exploit exists, and Open5GS resolved the flaw in version 2.7.2 with commit e89aa79efe629ae90f59dcdf8847c117d9a7da86.

Critical Impact
Remote attackers with low privileges can send malformed S6a Diameter messages to the HSS component, corrupting the stack of the open5gs-hssd process and potentially causing service disruption in 4G/5G core network deployments.

Affected Products

Open5GS versions up to and including 2.7.1
Open5GS HSS component (open5gs-hssd)
Diameter S6a Interface handlers (hss-s6a-path.c)

Discovery Timeline

2026-08-11 - CVE-2024-14042 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2024-14042

Vulnerability Analysis

Open5GS is an open-source implementation of 4G LTE and 5G core network components. The vulnerability affects the HSS module, which authenticates and authorizes subscribers over the Diameter S6a interface defined by 3GPP TS 29.272.

The callback handlers hss_ogs_diam_s6a_air_cb (Authentication Information Request) and hss_ogs_diam_s6a_ulr_cb (Update Location Request) process incoming Attribute-Value Pairs (AVPs). When parsing the Visited-PLMN-Id AVP, the code calls memcpy using the attacker-controlled os.len field as the copy length. Because the destination buffer visited_plmn_id is a fixed-size stack variable, any AVP with os.len larger than the destination overflows the stack.

This overflow can corrupt saved return addresses and adjacent stack data within the HSS daemon.

Root Cause

The root cause is missing length validation before a memcpy operation. The original code trusted the AVP's declared length without bounding it to the destination buffer size, a classic instance of [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Attack Vector

An attacker with the ability to send Diameter traffic to the HSS S6a endpoint can craft an Authentication Information Request or Update Location Request containing a Visited-PLMN-Id AVP with an oversized os.len value. The malformed AVP is processed by the affected callback, triggering the stack overflow. Exploitation requires network reachability to the Diameter interface and low-level authenticated access to the signaling network.

// Patched code from src/hss/hss-s6a-path.c
     ogs_assert(ret == 0);
     ret = fd_msg_avp_hdr(avp, &hdr);
     ogs_assert(ret == 0);
-    memcpy(&visited_plmn_id, hdr->avp_value->os.data, hdr->avp_value->os.len);
+    memcpy(&visited_plmn_id, hdr->avp_value->os.data,
+            ogs_min(hdr->avp_value->os.len, sizeof(visited_plmn_id)));

     milenage_generate(opc, auth_info.amf, auth_info.k,
         ogs_uint64_to_buffer(auth_info.sqn, OGS_SQN_LEN, sqn), auth_info.rand,

Source: GitHub Commit e89aa79. The fix bounds the copy length using ogs_min() against sizeof(visited_plmn_id), preventing out-of-bounds writes.

Detection Methods for CVE-2024-14042

Indicators of Compromise

Unexpected crashes or restarts of the open5gs-hssd process.
Diameter S6a AIR or ULR messages containing Visited-PLMN-Id AVPs with lengths exceeding 3 octets (the standard PLMN-Id size).
Segmentation faults recorded in HSS logs immediately following inbound Diameter traffic from unusual peers.

Detection Strategies

Deploy Diameter-aware inspection to validate AVP length fields against 3GPP specifications for the S6a interface.
Monitor process telemetry for abnormal termination signals on Open5GS core components.
Compare captured Diameter traffic against the reference PCAP published in GitHub Issue #3155 to identify similar exploit patterns.

Monitoring Recommendations

Enable verbose logging on the HSS and forward logs to a centralized SIEM for correlation of crashes with inbound Diameter peers.
Track connection attempts to the S6a Diameter endpoint from unauthorized or unexpected source addresses.
Alert on repeated AIR or ULR message failures from a single peer, which may indicate exploit attempts.

How to Mitigate CVE-2024-14042

Immediate Actions Required

Upgrade Open5GS to version 2.7.2 or later, which contains the patch commit e89aa79efe629ae90f59dcdf8847c117d9a7da86.
Restrict network access to the HSS S6a Diameter interface using firewall rules that only permit trusted MME peers.
Audit Diameter peer configurations to confirm mutual TLS or IPsec is enforced on signaling links.

Patch Information

The fix is available in the GitHub Release v2.7.2. The patch modifies src/hss/hss-s6a-path.c to cap the memcpy length using ogs_min(hdr->avp_value->os.len, sizeof(visited_plmn_id)). Full details are available in the GitHub Commit e89aa79 and tracked in VulDB CVE-2024-14042.

Workarounds

Isolate the HSS on a dedicated signaling VLAN reachable only by authenticated Diameter peers.
Enforce IPsec on the S6a reference point per 3GPP TS 33.310 recommendations to prevent unauthorized peers from sending crafted AVPs.
Deploy a Diameter routing agent or signaling firewall capable of validating AVP structure and length before forwarding to the HSS.

bash

# Upgrade Open5GS to the patched release
git clone https://github.com/open5gs/open5gs.git
cd open5gs
git checkout v2.7.2
meson build --prefix=`pwd`/install
ninja -C build
ninja -C build install

# Verify the installed version
open5gs-hssd -v