free5gc vulnerabilities

A vulnerability in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows an attacker to cause a Denial of Service (DoS) via a crafted POST request.

A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) by supplying a crafted payload.

An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.

An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.

A NULL pointer dereference in the UDMC registration handler component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) by supplying a crafted payload.

Improper input validation in the HandleUpdate function (/sbi/parameter_provision.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.

An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.

Improper input validation in the buildFilter function (processor/processor.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.

An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted snssais query.

An issue in free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) when parsing crafted SUCI data during UE registration.

An issue in the NAS decoder component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted Registration Request message.

Improper Input Validation in the HTTPModifySubscription handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

An issue in the CreateUEContextProcedure function (/v1/ue-contexts/{supi}) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PUT request.

In versions prior to 4.2.2, free5GC's SMF mounts the UPI management route group without inbound OAuth2 middleware. As a result, an unauthenticated DELETE /upi/v1/upNodesLinks/gNB1 request crashes the handler with a nil-pointer panic and mutates the in-memory user-plane topology.

In versions prior to 4.2.2, free5GC contains a type confusion bug in the POST /oauth2/token endpoint that can lead to server panic. This bug arises from improper handling of fields in the request, allowing an attacker to trigger server panic through a specially crafted request.

In versions prior to 4.2.2, the PATCH handler in free5GC for PFD management can panic due to a nil-pointer dereference when the UDR call fails and the consumer wrapper returns a non-nil error along with a nil *ProblemDetails. This leads to an HTTP 500 error being returned instead of a controlled error response.

In versions prior to 4.2.2, the PCF POST /npcf-smpolicycontrol/v1/sm-policies handler in free5GC panics due to a nil-pointer dereference when an OpenAPI consumer call returns a 404 error. Instead of returning an error, it continues execution, leading to a panic and returning an HTTP 500 error.

free5GC in version 4.2.2 and earlier has a vulnerability in the NRF RegisterNFInstance handler that accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. Invalid profiles are persisted in MongoDB and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled endpoints and redirect control-plane signaling. This issue is fixed in version 4.2.3.

free5GC before version 1.4.5 has a vulnerability in the AUSF component where cryptographic comparisons (RES* and XRES*, AT_MAC and XMAC) are performed using ordinary equality helpers, and the expected XRES* value is logged at INFO level. This can expose authentication material to parties with access to AUSF logs.

Vulnerability in free5GC (5G core network implementation) version 1.4.4 and earlier. The AUSF component stores authentication state in a global map, allowing an attacker with access to the SBI/N12 interface to send concurrent authentication requests for the same SUPI, overwriting the context and denying authentication to the selected subscriber. No fix available.

An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU.

An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request.

A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted NGAP messages during the initialization of a new RAN connection.

An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PATCH request.

In free5GC prior to version 1.4.5, the AUSF does not validate the supiOrSuci field in UE authentication requests. Null bytes and other control characters pass through JSON parsing and are forwarded to the UDM in an unescaped URL path, causing Go's net/url.Parse() to fail and return HTTP 500 with stack trace leakage. An unauthenticated attacker can cause denial of service for all subscribers attempting authentication through the affected AUSF.

Free5GC 4.2.0 has a type confusion vulnerability in the aper component, exploitable remotely but with high complexity.