Denial of Service in free5gc 4.1.0

Executive Summary

This vulnerability is in free5gc v4.1.0's ModifyAMFEventSubscriptionProcedure function. It allows attackers to cause a Denial of Service by sending a crafted PATCH request with a negative index in the path. The function uses strconv.Atoi to parse the index without validating if it is non-negative, leading to a runtime panic when accessing a slice with an invalid index.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor the free5GC AMF service logs for runtime panics or crashes after receiving PATCH requests to modify event subscriptions. Look for errors like 'panic: runtime error: slice bounds out of range' in logs. You can also test by sending crafted PATCH requests with negative indices in the path (e.g., /eventList/-1) to see if the service crashes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the AMF service to crash, disrupting network operations. If exploited, it may lead to service unavailability, affecting communication and data processing in the network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a Denial of Service (DoS) by crashing the AMF service in free5GC, which could disrupt critical network functions. For compliance with GDPR or HIPAA, such disruptions may lead to service unavailability, potentially violating availability requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update free5GC to the latest patched version if available. As a temporary fix, implement input validation in the ModifyAMFEventSubscriptionProcedure function to reject negative indices in the path before processing. Add checks to ensure the parsed index is non-negative before using it as a slice index.

Useful 0 Not Useful 0