Denial of Service in free5gc NAS Decoder

Executive Summary

This vulnerability is a Denial of Service (DoS) flaw in the free5GC software's NAS decoder. It occurs when the NAS decoder fails to validate the length of the 5GSID Information Element in a Registration Request message. An attacker crafts a message with a mismatched length field and longer actual content, causing an 'index out of range' panic during parsing. This leads to a nil pointer dereference in key functions, crashing the AMF process and halting service.

Useful 0 Not Useful 0

Detection Guidance

Monitor the AMF process logs for crashes or nil pointer dereference errors during NAS message parsing. Check for malformed Registration Request messages with inconsistent 5GSID length fields. Use network traffic analysis tools to inspect NAS PDUs for irregular length values in the 5GSID Information Element.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to crash the AMF process in free5GC, disrupting 5G network services. If exploited, it can cause complete service outages, preventing legitimate users from accessing network resources. Organizations using free5GC v4.0.1 on Ubuntu 20.04 Server are particularly vulnerable.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a Denial of Service (DoS) by crashing the AMF process in free5GC, which could disrupt critical network functions. For compliance with standards like GDPR or HIPAA, which require availability and integrity of systems processing personal data, such disruptions may violate requirements for uninterrupted service and data protection.

Useful 0 Not Useful 0

Mitigation Strategies

Update free5GC to the latest patched version. Apply input validation to ensure the 5GSID length field matches the actual content length in NAS messages. Restrict network access to the AMF component to trusted sources only. Monitor AMF processes for abnormal terminations and implement failover mechanisms.

Useful 0 Not Useful 0