Project: open5gs (open5gs/open5gs), language: c++
Vulnerability instance: open5gs.cve-2024-40129
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/open5gs/open5gs/issues/2585
## Description:
Issue: open5gs/open5gs#2585
Title: [Bug]: Possible heap-buffer-overflow in /lib/pfcp/context.c
State: closed
Created by: liuxiaoxinxinxin
Created at: 2023-09-05 14:50:54+00:00
Labels: type:bug

Issue Body:
### Open5GS Release, Revision, or Tag

v2.6.4

### Steps to reproduce

According to "Building Open5GS from Sources," I compiled Open5GS with ASAN on ubuntu 20.04.
Then I follow "Open5GS 5GC & UERANSIM UE / RAN Sample Configuration" and run Open5GS 5GC C-Plane, ASAN reported the following information:

### Logs

```shell
==5548==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f8fcb87c860 at pc 0x7f8fd0a02e3d bp 0x7ffd32cf7180 sp 0x7ffd32cf7178
WRITE of size 4 at 0x7f8fcb87c860 thread T0
    #0 0x7f8fd0a02e3c in ogs_pfcp_context_init /home/lxy/Downloads/open5gs-main/build/../lib/pfcp/context.c:78:62
    #1 0x4d5090 in smf_initialize /home/lxy/Downloads/open5gs-main/build/../src/smf/init.c:39:5
    #2 0x4d2d42 in app_initialize /home/lxy/Downloads/open5gs-main/build/../src/smf/app.c:26:10
    #3 0x4d4566 in main /home/lxy/Downloads/open5gs-main/build/../src/main.c:214:10
    #4 0x7f8fd03a9082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #5 0x426a7d in _start (/home/lxy/Downloads/open5gs-main/install/bin/open5gs-smfd+0x426a7d)

0x7f8fcb87c860 is located 0 bytes to the right of 262240-byte region [0x7f8fcb83c800,0x7f8fcb87c860)
allocated by thread T0 here:
    #0 0x4a1cdd in malloc (/home/lxy/Downloads/open5gs-main/install/bin/open5gs-smfd+0x4a1cdd)
    #1 0x7f8fd073ec86 in _talloc_zero (/lib/x86_64-linux-gnu/libtalloc.so.2+0x6c86)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/lxy/Downloads/open5gs-main/build/../lib/pfcp/context.c:78:62 in ogs_pfcp_context_init
Shadow bytes around the buggy address:
  0x0ff2797078b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff2797078c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff2797078d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff2797078e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ff2797078f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0ff279707900: 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa fa
  0x0ff279707910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff279707920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff279707930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff279707940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0ff279707950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==5548==ABORTING
```


### Expected behaviour

I expect that a heap-buffer-overflow scenario will not occur.
I am not quite sure whether this is a bug, any feedback would be appreciated.

### Observed Behaviour

After examining the call stack and reading the source code, I found that 
in /lib/core/ogs-pool.h line 152: (pool)->array[i] = i+1; 
then in lib/pfcp/context.c line 78: pdr_random_to_index[ogs_pfcp_pdr_teid_pool.array[i]] = i;
ogs_pfcp_pdr_teid_pool.array[i] may exceed the size of pdr_random_to_index, leading to a heap-buffer-overflow.
   



### eNodeB/gNodeB

_No response_

### UE Models and versions

_No response_


Comments:
Comment by acetcom on 2023-09-05 22:16:19+00:00:
@liuxiaoxinxinxin 

You're right. This is a bug of Open5GS. So I've fixed it in the main branch.

Thank you so much for your effort.
Sukchan

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
CFLAGS="$CFLAGS -Wno-compound-token-split-by-macro -Wno-format"
CXXFLAGS="$CFLAGS"
LDFLAGS="$CFLAGS"
sed -i "s|link_args: lib_fuzzing_engine|link_args: [lib_fuzzing_engine, '-ltalloc', '-Wl,-rpath,\$ORIGIN/lib']|" tests/fuzzing/meson.build
meson setup builddir --default-library=static -Dfuzzing=true -Dlib_fuzzing_engine="$LIB_FUZZING_ENGINE"
ninja -C builddir -k 0 || true

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get upgrade -y && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends python3-pip python3-setuptools python3-wheel ninja-build build-essential flex bison git cmake meson libsctp-dev libgnutls28-dev libgcrypt-dev libssl-dev libidn11-dev libmongoc-dev libbson-dev libmicrohttpd-dev libcurl4-gnutls-dev libnghttp2-dev libtins-dev libtalloc-dev iproute2 ca-certificates netbase pkg-config && apt-get install -y autoconf libtool-bin
RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends python3-pip python3-setuptools python3-wheel ninja-build build-essential flex bison git cmake meson libsctp-dev libgnutls28-dev libgcrypt-dev libssl-dev libidn11-dev libmongoc-dev libbson-dev libmicrohttpd-dev libcurl4-gnutls-dev libnghttp2-dev libtins-dev libtalloc-dev iproute2 ca-certificates netbase pkg-config && apt-get install -y autoconf libtool-bin
RUN apt-get install -y autoconf libtool-bin
RUN git clone https://github.com/open5gs/open5gs open5gs
RUN git -C open5gs checkout 2aa12449aade5f50ed4710d9ac2eb8e1b96c43b9
WORKDIR $SRC/open5gs
COPY build.sh $SRC/

Additional files: