NULL Pointer Dereference in free5gc CDR Processing Leads to DoS

Executive Summary

This vulnerability is a NULL pointer dereference in the free5GC project's CHF component, specifically in the OpenCDR function during CDR processing. When a request payload lacks the required nested field `pduSessionInformation`, the code attempts to access a field within it without checking if it exists, causing a crash.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or 500 Internal Server Errors in the free5GC CHF component. Check logs for nil pointer dereference errors in CDR processing. Send test requests to the charging endpoint with malformed payloads omitting pduSessionInformation to observe crashes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a Denial of Service (DoS) by crashing the free5GC server when processing malformed requests. The server may return a 500 error or drop connections, disrupting services dependent on free5GC.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a Denial of Service (DoS) by crashing the free5GC server due to a NULL pointer dereference. Such disruptions could lead to service unavailability, potentially violating availability requirements in GDPR and HIPAA, which mandate timely access to personal and health data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade free5GC to a patched version where the CHF component validates request structures. Implement input validation to reject requests missing pduSessionInformation. Temporarily block malformed requests at the network level until patched.

Useful 0 Not Useful 0