CVE-2023-50019: Improper Handling of Exceptional Conditions (CWE-755)
value: An issue was discovered in open5gs v2.6.6. InitialUEMessage, Registration request sent at a specific time can crash AMF due to incorrect error handling of Nudm_UECM_Registration response.
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 5.9
Published: 2024-01-02T22:15Z
Repository: https://github.com/open5gs/open5gs
Language: C
Files changed: src/amf/gmm-sm.c
Commit date: 2023-11-25 21:21:23 +0900
Commit message: [AMF] Fixed Nudm_UECM_Registration crash (#2733)

1. UE sends RegistrationRequest to AMF.
2. AMF sends Nudm_UECM_Registration to UDM.
3. UE sends RegistrationRequest to AMF.
4. GMM state is gmm_state_authentication
5. UDM sends Nudm_UECM_Registration response to AMF.
6. AMF crashs since no Handler in gmm_state_authentication state

Diff: diff --git a/src/amf/gmm-sm.c b/src/amf/gmm-sm.c
index 9ce0a8952d..d94096af5f 100644
--- a/src/amf/gmm-sm.c
+++ b/src/amf/gmm-sm.c
@@ -1714,10 +1714,43 @@ void gmm_state_authentication(ogs_fsm_t *s, amf_event_t *e)
                         sbi_message->h.resource.component[0]);
                 ogs_assert_if_reached();
             END
             break;
 
+        CASE(OGS_SBI_SERVICE_NAME_NUDM_UECM)
+            if (sbi_message->res_status != OGS_SBI_HTTP_STATUS_CREATED &&
+                sbi_message->res_status != OGS_SBI_HTTP_STATUS_NO_CONTENT &&
+                sbi_message->res_status != OGS_SBI_HTTP_STATUS_OK) {
+                ogs_error("[%s] HTTP response error [%d]",
+                        amf_ue->supi, sbi_message->res_status);
+            }
+
+            SWITCH(sbi_message->h.resource.component[1])
+            CASE(OGS_SBI_RESOURCE_NAME_REGISTRATIONS)
+                SWITCH(sbi_message->h.method)
+                CASE(OGS_SBI_HTTP_METHOD_PUT)
+                    /*
+                     * Issue #2733
+                     *
+                     * We need to ignore this message in this state.
+                     */
+                    ogs_error("[%s] Ignore SBI message", amf_ue->supi);
+                    break;
+                DEFAULT
+                    ogs_error("[%s] Invalid HTTP method [%s]",
+                            amf_ue->suci, sbi_message->h.method);
+                    ogs_assert_if_reached();
+                END
+                break;
+
+            DEFAULT
+                ogs_error("Invalid resource name [%s]",
+                        sbi_message->h.resource.component[1]);
+                ogs_assert_if_reached();
+            END
+            break;
+
         DEFAULT
             ogs_error("Invalid service name [%s]", sbi_message->h.service.name);
             ogs_assert_if_reached();
         END
         break;

Fixed code:         CASE(OGS_SBI_SERVICE_NAME_NUDM_UECM)
            if (sbi_message->res_status != OGS_SBI_HTTP_STATUS_CREATED &&
                sbi_message->res_status != OGS_SBI_HTTP_STATUS_NO_CONTENT &&
                sbi_message->res_status != OGS_SBI_HTTP_STATUS_OK) {
                ogs_error("[%s] HTTP response error [%d]",
                        amf_ue->supi, sbi_message->res_status);
            }

            SWITCH(sbi_message->h.resource.component[1])
            CASE(OGS_SBI_RESOURCE_NAME_REGISTRATIONS)
                SWITCH(sbi_message->h.method)
                CASE(OGS_SBI_HTTP_METHOD_PUT)
                    /*
                     * Issue #2733
                     *
                     * We need to ignore this message in this state.
                     */
                    ogs_error("[%s] Ignore SBI message", amf_ue->supi);
                    break;
                DEFAULT
                    ogs_error("[%s] Invalid HTTP method [%s]",
                            amf_ue->suci, sbi_message->h.method);
                    ogs_assert_if_reached();
                END
                break;

            DEFAULT
                ogs_error("Invalid resource name [%s]",
                        sbi_message->h.resource.component[1]);
                ogs_assert_if_reached();
            END
            break;