free5gc vulnerabilities

In versions prior to 4.2.2, free5GC's SMF mounts the UPI management route group without inbound OAuth2 middleware. As a result, an unauthenticated DELETE /upi/v1/upNodesLinks/gNB1 request crashes the handler with a nil-pointer panic and mutates the in-memory user-plane topology.

In versions prior to 4.2.2, free5GC contains a type confusion bug in the POST /oauth2/token endpoint that can lead to server panic. This bug arises from improper handling of fields in the request, allowing an attacker to trigger server panic through a specially crafted request.

In versions prior to 4.2.2, the PATCH handler in free5GC for PFD management can panic due to a nil-pointer dereference when the UDR call fails and the consumer wrapper returns a non-nil error along with a nil *ProblemDetails. This leads to an HTTP 500 error being returned instead of a controlled error response.

In versions prior to 4.2.2, the PCF POST /npcf-smpolicycontrol/v1/sm-policies handler in free5GC panics due to a nil-pointer dereference when an OpenAPI consumer call returns a 404 error. Instead of returning an error, it continues execution, leading to a panic and returning an HTTP 500 error.

free5GC in version 4.2.2 and earlier has a vulnerability in the NRF RegisterNFInstance handler that accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. Invalid profiles are persisted in MongoDB and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled endpoints and redirect control-plane signaling. This issue is fixed in version 4.2.3.

A vulnerability was determined in Free5GC up to 4.2.3 affecting unknown code of file /corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handler.go (Gmm Handler component). Manipulation causes a race condition. The attack can be initiated remotely and the patch is identified as e323b01464355781b8b8d5dd695e05cbc00a62f2.

In free5GC 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in internal/sbi/api_datarepository.go validate the ueId path value with a regular expression whose final .+ alternative accepts any non-empty string instead of restricting identifiers to supported SUPI and GPSI formats. An actor with network reachability to the UDR SBI can submit a non-3GPP identifier to /nudr-dr/v2/subscription-data/{ueId}/context-data/ee-subscriptions, causing it to pass validation and enter the normal create or query flow. Invalid identifiers can be persisted and retrieved as subscription records.

An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component.

free5GC before version 1.4.5 has a vulnerability in the AUSF component where cryptographic comparisons (RES* and XRES*, AT_MAC and XMAC) are performed using ordinary equality helpers, and the expected XRES* value is logged at INFO level. This can expose authentication material to parties with access to AUSF logs.

Vulnerability in free5GC (5G core network implementation) version 1.4.4 and earlier. The AUSF component stores authentication state in a global map, allowing an attacker with access to the SBI/N12 interface to send concurrent authentication requests for the same SUPI, overwriting the context and denying authentication to the selected subscriber. No fix available.

A vulnerability in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows an attacker to cause a Denial of Service (DoS) via a crafted POST request.

A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) by supplying a crafted payload.

An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.

An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.

A NULL pointer dereference in the UDMC registration handler component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) by supplying a crafted payload.

Improper input validation in the HandleUpdate function (/sbi/parameter_provision.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.

An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.

Improper input validation in the buildFilter function (processor/processor.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via crafted input.

An issue in the NF Discovery endpoint of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted snssais query.

An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU.

An issue in free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) when parsing crafted SUCI data during UE registration.

An issue in the NAS decoder component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted Registration Request message.

Improper Input Validation in the HTTPModifySubscription handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request.

A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted NGAP messages during the initialization of a new RAN connection.

An issue in the CreateUEContextProcedure function (/v1/ue-contexts/{supi}) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PUT request.

An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PATCH request.

In free5GC prior to version 1.4.5, the AUSF does not validate the supiOrSuci field in UE authentication requests. Null bytes and other control characters pass through JSON parsing and are forwarded to the UDM in an unescaped URL path, causing Go's net/url.Parse() to fail and return HTTP 500 with stack trace leakage. An unauthenticated attacker can cause denial of service for all subscribers attempting authentication through the affected AUSF.

Free5GC 4.2.0 has a type confusion vulnerability in the aper component, exploitable remotely but with high complexity.

An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified impacts via crafted header Local SEID to the PFCP Session Modification Request.