CVE-2024-14043

The vulnerability in Open5GS is a heap overflow in `mme_s6a_subscription_data_from_avp` where the `msisdn_len` value extracted from a Diameter AVP is used directly as the copy size into a fixed-size heap buffer, without any independent bounds validation against the destination. This is a textbook trusted length-field coupling failure — the function assumes the peer-provided length is constrained by protocol semantics, but a malicious or compromised Diameter peer can send arbitrary values. The critical detail that elevates this beyond a standard parsing bug: the S6a interface processes subscription data during normal device attach procedures. This means the vulnerable code path executes in a pre-authentication window — any device attempting to register can trigger the overflow, not just authenticated administrative peers. The CVSS 6.3 score substantially understates the exposure because it measures byte-level severity rather than the functional blast radius. The MME is the keystone of device attachment; corrupting subscription data in this path can destabilize the authentication state machine, potentially cascading into handover failures, session management errors, or authentication loops across the radio access network. The patch (commit 7ea82cb87) adds a bounds check in this specific function, but the underlying pattern — untrusted length fields from network sources used directly as copy sizes — has recurred identically across DNS response parsing, TLS record layer handling, HTTP chunked transfer decoding, and multiple proprietary 3G/4G stack implementations. The telecom protocol parsing ecosystem keeps rediscovering this same vulnerability class without institutionalizing the defensive discipline. What to check: verify your Open5GS deployment has the fix applied. If you're running older versions, the S6a path is remotely triggerable during attach — there's no administrative access requirement. Consider network-level Diameter peer authentication as a defense-in-depth layer, even if your deployment assumes trusted peers. The code path handling subscription data parsing receives far less scrutiny than active feature development, so assume similar patterns may exist in adjacent parsing code until proven otherwise.

Reviewed through automated stages and approved by a human before publication.