Denial of Service in free5gc CreateUEContext Handler

Executive Summary

This vulnerability is a denial-of-service (DoS) issue in free5GC v4.1.0's AMF component. When the CreateUEContext handler receives an HTTP request with a multipart/related Content-Type header, it incorrectly tries to deserialize the payload using openapi.Deserialize. This causes a panic due to an illegal reflection operation on a slice, crashing the AMF process and making it unavailable.

Useful 0 Not Useful 0

Detection Guidance

Monitor AMF logs for crashes with the error message 'reflect: call of reflect.Value.FieldByName on slice Value' after receiving PUT requests to /namf-comm/v1/ue-contexts/any-ue-id with Content-Type: multipart/related headers.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can crash the AMF process in free5GC, disrupting network services. The AMF is critical for managing user equipment contexts, so its unavailability leads to a DoS, preventing legitimate users from accessing network resources.

Useful 0 Not Useful 0

Mitigation Strategies

Update free5GC to a patched version that properly handles multipart/related content in the AMF component. If an update is unavailable, restrict access to the /namf-comm/v1/ue-contexts/any-ue-id endpoint and filter requests with multipart/related Content-Type headers.

Useful 0 Not Useful 0