Denial of Service in free5gc NRF Discovery Service

Executive Summary

This vulnerability is a Denial of Service (DoS) issue in the free5GC NRF Discovery service. It occurs in the complexQueryFilterSubprocess function when processing a malformed tai parameter. The function crashes due to an index out of range error when accessing taiSplit[1] without checking if the split operation produced at least two elements.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor the NRF Discovery service logs for crashes or panics related to the complexQueryFilterSubprocess function. Check for malformed tai parameter inputs that cause index out of range errors. Use commands like 'journalctl -u free5gc-nrf' or 'grep -i panic /var/log/free5gc/*.log' to identify crashes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the NRF Discovery service to crash, leading to a Denial of Service. If the service terminates and lacks proper panic recovery, it may disrupt network functions relying on free5GC, potentially affecting 5G network operations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update free5GC to the latest version that patches this issue. If an update is not available, modify the complexQueryFilterSubprocess function to validate the taiSplit slice length before accessing elements and return an HTTP 400 error for malformed inputs. Temporarily restrict access to the NRF Discovery service if possible.

Useful 0 Not Useful 0