CVE-2022-39063
When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Response. Once UPF receives a request, it gets the f_teid_len from incoming message, and then uses it to copy data from incoming message to struct f_teid without checking the maximum length. If the pdi.local_f_teid.len exceeds the maximum length of the struct of f_teid, the memcpy() overwrites the fields (e.g., f_teid_len) after f_teid in the pdr struct. After parsing the request, the UPF starts to build a response. The f_teid_len with its overwritten value is used as a length for memcpy(). A segmentation fault occurs, as a result of a memcpy(), if this overwritten value is large enough.
Scoring
- CVSS base score
- 0.02
- EPSS probability
- 0.59%
- CWE
- CWE-676
- Published
- 2022-09-16
- Last modified
- 2026-03-13
Affected products
- Open5GS Open5GS
Weakness type
Related vulnerabilities
- CVE-2025-14601 — vsDesk Task Scheduler OS Command Injection
- CVE-2026-14501 — Use of Potentially Dangerous Functionthat in IBM Db2 Genius Hub
- CVE-2026-54499 — Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders
- CVE-2025-67604 — A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer 7.6.0 through...
- CVE-2025-65117 — AVEVA Process Optimization Use of Potentially Dangerous Function
- CVE-2024-50307 — Use of potentially dangerous function issue exists in Chatwork Desktop Application (Windows)...
- CVE-2024-38434 — Unitronics Vision PLC - CWE-676: Use of Potentially Dangerous Function
- CVE-2021-27474 — Rockwell Automation FactoryTalk AssetCentre Use of Potentially Dangerous Function