A critical denial-of-service vulnerability in the omec-project UPF component allows remote, unauthenticated attackers to cause service instability and process termination.

This is a memory safety vulnerability where the Flow-Description parser fails to perform robust validation, leading to out-of-bounds memory access. Unauthenticated attackers can trigger this condition by sending a specially crafted PFCP Session Establishment Request to the N4/PFCP endpoint.

The successful exploitation of this vulnerability results in the termination of the UPF process, leading to a denial-of-service for network traffic passing through the affected infrastructure. Given the critical role of the UPF in mobile core networks, this service interruption could lead to significant operational downtime and loss of connectivity for end users. The CVSS score of 7.5 reflects the high availability impact and the ease with which an unauthenticated attacker can disrupt services.

Immediate Action: As no specific patch version is currently available, restrict network access to the UPF N4/PFCP endpoint to trusted control plane entities only.

Proactive Monitoring: Monitor system logs for repeated process panics or unexpected service restarts of the pfcpiface component.

Compensating Controls: Implement strict firewall rules or access control lists to ensure that only authorized PFCP entities can communicate with the N4 interface.

Public Exploit Available: Unknown.

This vulnerability poses a significant risk to network availability due to the ease of remote exploitation. Security teams should immediately isolate the N4/PFCP interface from untrusted networks and prioritize the deployment of vendor security updates as soon as they are released to remediate the underlying logic error.