Denial of Service in free5gc NGAP Handler

Executive Summary

This vulnerability is a Denial of Service (DoS) issue in the free5GC software's AMF component. It occurs when the NGAP handler processes a malformed NAS PDU without proper validation. A crafted input, such as a single-byte message, causes an out-of-bounds memory access in the nas.GetSecurityHeaderType function. This triggers a panic, crashing the AMF process and severing connections.

Useful 0 Not Useful 0

Detection Guidance

Monitor the AMF process for crashes or panics, especially after receiving NAS PDUs. Check logs for errors like 'index out of range [1] with length 1' or runtime crashes in the NGAP handler.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can crash the AMF process in free5GC, leading to service disruption. Users relying on free5GC for 5G network functions may experience downtime, loss of connectivity, or degraded performance. Attackers could send specially crafted messages to trigger the crash remotely.

Useful 0 Not Useful 0

Mitigation Strategies

Update free5GC to a patched version if available. Implement input validation for NAS PDUs in the NGAP handler to prevent malformed data from causing crashes.

Useful 0 Not Useful 0