CVE-2024-14043: Open5GS Buffer Overflow Vulnerability

CVE-2024-14043 Overview

CVE-2024-14043 is a heap-based buffer overflow vulnerability in Open5GS versions up to 2.7.1. The flaw resides in the mme_s6a_subscription_data_from_avp function within src/mme/mme-fd-path.c, part of the Diameter S6a Interface component used by the Mobility Management Entity (MME). An attacker can manipulate the msisdn_len argument to trigger the overflow, and the attack is executable remotely. The vulnerability is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). A public exploit disclosure exists, and the issue is resolved in Open5GS version 2.7.2 through commit 7ea82cb87bb65c3694d8d7c7a5efed1c4d3c9304.

Critical Impact
Remote attackers can trigger a heap-based buffer overflow in the Open5GS MME Diameter S6a handler, potentially corrupting adjacent heap memory in a core LTE/5G network component.

Affected Products

Open5GS versions up to and including 2.7.1
Open5GS MME (Mobility Management Entity) component
Diameter S6a Interface implementation in src/mme/mme-fd-path.c

Discovery Timeline

2026-08-12 - CVE-2024-14043 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2024-14043

Vulnerability Analysis

The vulnerability exists in the mme_s6a_subscription_data_from_avp function that processes Diameter Attribute-Value Pairs (AVPs) received over the S6a interface. This interface connects the MME to the Home Subscriber Server (HSS) and carries subscriber authentication and subscription data. The function extracts the MSISDN (Mobile Station International Subscriber Directory Number) length directly from an AVP field without bounding it against the fixed destination buffer size OGS_MAX_MSISDN_LEN.

When a malicious or malformed Diameter message contains an MSISDN AVP with a length exceeding the destination buffer, the subsequent memcpy operation writes past the allocated heap region. This corrupts adjacent heap metadata and data structures within the MME process.

Root Cause

The root cause is improper input validation on the AVP length field. The pre-patch code assigned hdr->avp_value->os.len directly to mme_ue->msisdn_len before invoking memcpy. Although ogs_min was used inside memcpy, the assignment of the untrusted length to msisdn_len propagated the oversized value to the subsequent ogs_buffer_to_bcd call, which then processed memory beyond the buffer bounds.

Attack Vector

An attacker with network access to the S6a interface, or the ability to inject Diameter messages into that path, can craft a subscription data response containing an MSISDN AVP with an oversized os.len value. Because the Diameter S6a interface is part of the mobile core signaling plane, exploitation requires reachability to the MME's Diameter endpoint or a compromised HSS-side peer.

         ret = fd_msg_avp_hdr(avpch1, &hdr);
         ogs_assert(ret == 0);
         if (hdr->avp_value->os.data && hdr->avp_value->os.len) {
-            mme_ue->msisdn_len = hdr->avp_value->os.len;
-            memcpy(mme_ue->msisdn, hdr->avp_value->os.data,
-                    ogs_min(mme_ue->msisdn_len, OGS_MAX_MSISDN_LEN));
+            mme_ue->msisdn_len =
+                ogs_min(hdr->avp_value->os.len, OGS_MAX_MSISDN_LEN);
+            memcpy(mme_ue->msisdn, hdr->avp_value->os.data, mme_ue->msisdn_len);
             ogs_buffer_to_bcd(mme_ue->msisdn,
                     mme_ue->msisdn_len, mme_ue->msisdn_bcd);
             *subdatamask = (*subdatamask | OGS_DIAM_S6A_SUBDATA_MSISDN);

Source: Open5GS Commit 7ea82cb. The patch clamps msisdn_len to OGS_MAX_MSISDN_LEN before it is stored and used, preventing propagation of the oversized length.

Detection Methods for CVE-2024-14043

Indicators of Compromise

Unexpected crashes or restarts of the open5gs-mmed process, particularly with heap corruption signatures in core dumps
Diameter S6a messages containing MSISDN AVPs with lengths exceeding OGS_MAX_MSISDN_LEN
Malformed or oversized Subscription-Data AVPs received from HSS peers or untrusted Diameter endpoints

Detection Strategies

Inspect Diameter S6a traffic for AVP length fields that exceed protocol-expected values, particularly on MSISDN attributes
Monitor Open5GS MME logs for assertion failures, segmentation faults, or abnormal termination events
Compare running Open5GS binaries against version 2.7.2 to identify unpatched deployments

Monitoring Recommendations

Enable process crash monitoring on hosts running open5gs-mmed and forward core dumps to centralized analysis
Capture packet traces at Diameter S6a interfaces during suspected exploitation attempts, referencing the sample capture provided in the issue report
Alert on repeated Diameter peer disconnects or malformed AVP parsing errors in MME telemetry

How to Mitigate CVE-2024-14043

Immediate Actions Required

Upgrade all Open5GS deployments to version 2.7.2 or later, which contains commit 7ea82cb87bb65c3694d8d7c7a5efed1c4d3c9304
Restrict network access to the MME Diameter S6a endpoint using firewall rules that allow only trusted HSS peers
Audit Diameter peer configurations to ensure mutual authentication and TLS/DTLS transport where supported

Patch Information

The fix is available in Open5GS Release v2.7.2. The patched code clamps mme_ue->msisdn_len to OGS_MAX_MSISDN_LEN using ogs_min before storing the length or performing the memcpy. Details of the change are documented in Open5GS Issue #3156 and the VulDB entry for CVE-2024-14043.

Workarounds

Segment the Diameter signaling network so only authenticated HSS nodes can reach the MME S6a port
Deploy a Diameter routing agent or firewall capable of validating AVP length fields against protocol maximums before forwarding to the MME
Enable process supervision and automatic restart for open5gs-mmed to reduce service outage impact if a crash is triggered

bash

# Verify installed Open5GS version and upgrade to patched release
open5gs-mmed -v
git clone https://github.com/open5gs/open5gs.git
cd open5gs
git checkout v2.7.2
meson build --prefix=`pwd`/install
ninja -C build install