NULL Pointer Dereference in free5gc v4.0.1 Causes DoS

Executive Summary

This vulnerability is a NULL pointer dereference in the UDMC registration handler of free5gc v4.0.1. It occurs when the RegistrationAmf3gppAccessProcedure function processes an incomplete Amf3GppAccessRegistration payload without validating required nested fields. A malformed JSON payload causes the handler to access nil fields, leading to a runtime panic and Denial of Service (DoS).

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes in the free5GC UDM service when processing registration requests. Check logs for 'invalid memory address or nil pointer dereference' errors. Use network traffic inspection tools like tcpdump or Wireshark to capture malformed JSON payloads sent to the UDM registration endpoint.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can crash the free5GC service, causing a Denial of Service (DoS). If exploited, it may disrupt network operations relying on free5GC, leading to service unavailability for users and potential downtime in 5G network functions.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade free5GC to a patched version if available. Implement input validation for JSON payloads in the UDM registration handler to reject malformed requests. Temporarily restrict access to the UDM registration endpoint via firewall rules until patched.

Useful 0 Not Useful 0