CVE-2024-14044

The CVSS 6.3 rating for CVE-2024-14044 obscures a more dangerous reality: a buffer overflow in Open5GS's PCRF component that can contaminate policy enforcement across every session the PCRF manages, not just the single connection exploited. The vulnerability lives in the Diameter Rx handler's pcrf_rx_aar_cb function, where num_of_media_component and num_of_sub parameters—derived from AAR messages—lack bounds validation. Compromising the PCRF doesn't crash one subscriber session; it corrupts the policy rules that a P-GW enforces across its entire subscriber population, with malformed charging directives potentially propagating to the OCS through Gy/Gz interfaces. This cascade topology (Rx → Gx → Gy/Gz) means a single overflow exploit can poison policy state for thousands of concurrent sessions. The EPSS score of 0.00482 is calibrated for carrier network topologies with robust segmentation, but Open5GS's actual deployment population—research networks, neutral-host 5G, private enterprise islands—typically lacks those perimeter controls. The 'authenticated but network-adjacent' protection layer is thinner in these environments, meaning the exploitation likelihood model doesn't fit this population. If adjacent network segments implicitly trust PCRF policy decisions without secondary validation, a compromised Application Function or insider threat can weaponize the Rx interface's trust relationships. For immediate action: verify your Open5GS deployment version (prior to 2.7.2 is vulnerable), audit whether the PCRF's Rx interface is exposed to any network segment beyond strictly controlled Application Functions, and treat this as a priority patch despite the medium CVSS rating. The real question isn't severity—it's blast radius. A buffer overflow in a policy enforcement function with a documented cascade path and public exploit is structurally different from an equivalent flaw in a stateless service, even when CVSS treats them similarly.

Reviewed through automated stages and approved by a human before publication.