Free5GC SMF Null Pointer Dereference Vulnerability in PFCP Association Release Request Handling

A null pointer dereference vulnerability has been identified in Free5GC SMF versions through 4.1.0. The issue arises in the PFCP UDP Endpoint component, specifically within the HandlePfcpAssociationReleaseRequest function of handler.go. When a PFCP Association Release Request is sent without the required NodeID Information Element, the handler attempts to dereference a nil NodeID, leading to a runtime panic. This vulnerability can be exploited remotely, causing the SMF process to crash and terminate, which disrupts service availability.

Impact

Exploitation of this vulnerability causes the SMF process to crash, terminating all active sessions and disrupting service.

Reproduction

The vulnerability can be reproduced by sending a PFCP Association Release Request that omits the NodeID Information Element. This can be done using a crafted UDP packet that simulates the PFCP message without the required NodeID, targeting the SMF's PFCP UDP endpoint.

Remediation

Users are advised to update to Free5GC SMF version 4.1.1 or later, where this vulnerability has been fixed.