CVE-2024-14044: Open5GS Buffer Overflow Vulnerability

CVE-2024-14044 Overview

CVE-2024-14044 is a buffer overflow vulnerability in Open5GS versions up to and including 2.7.1. The flaw resides in the pcrf_rx_aar_cb function within src/pcrf/pcrf-rx-path.c, part of the Diameter Rx Handler component. Attackers can trigger the overflow by manipulating the num_of_media_component and num_of_sub arguments in Diameter Rx AAR messages. The attack is remotely exploitable and a public exploit exists. Open5GS resolved the issue in version 2.7.2 via commit 87b4e4535c77ded627cdb6f4e4e2e3ea761f40b7. The vulnerability is classified under [CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer].

Critical Impact
Remote attackers with low privileges can trigger a stack overflow in the Policy and Charging Rules Function (PCRF) of an Open5GS 5G core network deployment, affecting confidentiality, integrity, and availability of the service.

Affected Products

Open5GS versions up to and including 2.7.1
Open5GS PCRF/PCF Diameter Rx Handler component
File: src/pcrf/pcrf-rx-path.c, function pcrf_rx_aar_cb

Discovery Timeline

2026-08-12 - CVE-2024-14044 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2024-14044

Vulnerability Analysis

Open5GS implements a 5G core and EPC stack in C. The PCRF handles Diameter Rx AAR (Authentication-Authorization-Request) messages from the P-CSCF for IMS session control. Inside pcrf_rx_aar_cb, the handler iterates over Media-Component-Description AVPs and Sub-Component AVPs received in the request. For each AVP, the code writes into fixed-size arrays rx_message.ims_data.media_component[] and its sub[] array, incrementing num_of_media_component and num_of_sub respectively. The function did not validate these counters against the array bounds defined by OGS_MAX_NUM_OF_MEDIA_COMPONENT before indexing. An attacker able to send a crafted Diameter Rx message containing more media components or sub-components than the fixed capacity triggers a stack overflow in the PCRF process.

Root Cause

The root cause is missing bounds validation on Diameter AVP counters before array indexing. The rx_message.ims_data structure holds media-component data in stack-resident fixed-size arrays. Without an upper-bound check, attacker-controlled counters advance past the last valid element and overwrite adjacent stack memory [CWE-119].

Attack Vector

A remote attacker with the ability to submit Diameter Rx AAR messages to the PCRF (typically a peer application function such as a compromised or malicious P-CSCF) sends a request containing an excessive number of Media-Component-Description or Sub-Component AVPs. The handler processes each AVP and writes past the end of the fixed-size arrays, corrupting stack memory. Depending on layout and mitigations, the effect ranges from a PCRF crash (denial of service against IMS/policy control) to potential memory corruption impacting confidentiality, integrity, and availability of the affected core network function.

            break;
        /* Gwt Media-Component-Description */
        case OGS_DIAM_RX_AVP_CODE_MEDIA_COMPONENT_DESCRIPTION:
+           if (rx_message.ims_data.num_of_media_component >=
+                   OGS_ARRAY_SIZE(rx_message.ims_data.media_component)) {
+               ogs_error("OVERFLOW rx_message.ims_data.num_of_media_component "
+                       "[%d:%d:%d]",
+                       rx_message.ims_data.num_of_media_component,
+                       OGS_MAX_NUM_OF_MEDIA_COMPONENT,
+                       (int)OGS_ARRAY_SIZE(
+                           rx_message.ims_data.media_component));
+               break;
+           }
            media_component = &rx_message.ims_data.
                    media_component[rx_message.ims_data.num_of_media_component];

Source: GitHub Commit 87b4e453 — the patch adds an explicit bounds check comparing num_of_media_component against OGS_ARRAY_SIZE(...) and aborts processing of additional AVPs when the array is full.

Detection Methods for CVE-2024-14044

Indicators of Compromise

PCRF or PCF process crashes, restarts, or segmentation faults in open5gs-pcrfd logs coinciding with inbound Diameter Rx traffic.
Presence of the string OVERFLOW rx_message.ims_data.num_of_media_component in ogs_error log output on patched builds, indicating a rejected malformed request.
Diameter Rx AAR messages containing anomalously high counts of Media-Component-Description or Sub-Component AVPs. A reproducer packet capture is published as capture.pcap.gz.

Detection Strategies

Deploy Diameter protocol inspection to flag AAR messages whose AVP counts exceed operator-defined thresholds for OGS_MAX_NUM_OF_MEDIA_COMPONENT.
Monitor Open5GS process telemetry for abnormal restart loops or core dumps on the PCRF host.
Correlate Diameter peer connections with unexpected source identities on the Rx reference point.

Monitoring Recommendations

Enable verbose Open5GS logging at the PCRF and alert on ogs_error entries related to rx_message.ims_data.
Ingest PCRF host and application logs into a centralized SIEM for cross-correlation with Diameter peer activity.
Baseline normal AAR AVP counts across your subscriber population so that outliers can be flagged automatically.

How to Mitigate CVE-2024-14044

Immediate Actions Required

Upgrade Open5GS to version 2.7.2 or later, which includes commit 87b4e4535c77ded627cdb6f4e4e2e3ea761f40b7.
Restrict Diameter Rx peer connectivity to authenticated, trusted P-CSCF nodes using IPsec or TLS on SCTP/TCP transport.
Review PCRF and PCF logs for prior crashes or anomalous AAR traffic that could indicate exploitation attempts.

Patch Information

The fix is included in the Open5GS v2.7.2 release. The patch commit is 87b4e4535c77ded627cdb6f4e4e2e3ea761f40b7, and the underlying report is tracked in Open5GS Issue #3157. Additional metadata is available at VulDB CVE-2024-14044.

Workarounds

Segment the Diameter Rx interface on a private control-plane network and block Rx traffic from untrusted sources at the firewall.
Enforce strict Diameter peer allow-lists in Open5GS configuration to limit which peers can initiate AAR sessions with the PCRF.
Deploy a Diameter routing agent or signaling firewall in front of Open5GS to filter AAR messages with excessive AVP counts until patching is complete.

bash

# Upgrade Open5GS to the patched release
git clone https://github.com/open5gs/open5gs.git
cd open5gs
git checkout v2.7.2
meson build --prefix=`pwd`/install
ninja -C build
ninja -C build install

# Verify the patched function contains the bounds check
grep -n "OVERFLOW rx_message.ims_data.num_of_media_component" \
    src/pcrf/pcrf-rx-path.c