Denial of Service in free5gc UE Registration

Executive Summary

This vulnerability in free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) by sending crafted SUCI data during UE registration. The issue occurs in the AMF when parsing malformed SUCI data, leading to a runtime panic due to invalid array index access in the nasType.(*MobileIdentity5GS).GetSUCI function.

Useful 0 Not Useful 0

Detection Guidance

Monitor AMF service logs for crashes or runtime panics during UE registration, particularly when processing SUCI data. Check for 'index out of range' errors in logs. Inspect NGAP registration requests for malformed SUCI fields with invalid PLMN identifiers or mismatched length fields.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can disrupt legitimate user registrations by crashing the AMF service, leaving resources unreleased. Attackers can exploit it by sending a malformed NGAP registration request, causing service disruptions for all users relying on the free5GC system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a Denial of Service (DoS) by crashing the free5GC AMF service during UE registration due to malformed SUCI data. Such disruptions could impact availability of critical telecom services, potentially violating compliance requirements for data processing and system reliability under standards like GDPR (availability principle) and HIPAA (system availability and integrity).

Useful 0 Not Useful 0

Mitigation Strategies

Update free5GC to a patched version if available. Implement input validation for SUCI data in the AMF to reject malformed messages. Configure AMF to handle errors gracefully without crashing. Monitor and restrict network traffic to prevent crafted NGAP requests.

Useful 0 Not Useful 0