Free5GC Denial-of-Service Vulnerability in AMF Component

A denial-of-service vulnerability has been identified in Free5GC version 4.1.0, specifically within the AMF component's 'HandleRegistrationComplete' function in the 'internal/gmm/handler.go' file. The issue arises when the AMF receives an out-of-sequence NAS message during the registration process, causing the AMF process to crash. This vulnerability can be exploited remotely, without any authentication.

Impact

Exploitation of this vulnerability leads to a crash of the AMF process, causing a denial-of-service condition where the service is unavailable or unresponsive.

Reproduction

To reproduce this vulnerability, send a UplinkNASTransport message that includes a Registration Complete NAS message, after the AMF has processed the Security Mode Complete step and entered the 'Waiting for Identity Response' state. This out-of-sequence message will cause the AMF to crash.

Remediation

Users are advised to update to Free5GC version 4.2.0, where this issue has been fixed.