Free5gc Buffer Overflow Vulnerability in AMF Component Allowing Denial-of-Service

A buffer overflow vulnerability has been identified in Free5gc version 4.0.1 within the Access and Mobility Management Function (AMF). The issue arises because the AMF improperly validates the 5GS mobile identity, leading to an overflow in the slice reference. This flaw can be exploited by sending crafted NGAP messages, causing the AMF to crash.

Impact

Exploitation of this vulnerability leads to a crash of the AMF component, causing a denial-of-service condition in the 5G core network.

Reproduction

To reproduce this vulnerability, first start the Free5gc 5G core network. Then, send an NGAP message of 'NGSetupRequest' to the AMF over SCTP. After that, send another NGAP message of 'InitialUEMessage' that includes a valid NAS PDU. The AMF will crash upon processing this message.

Remediation

Users can update to Free5gc version 4.0.2, where this vulnerability has been fixed.