Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The AUSF component of free5GC compares authentication response values with normal Go equality helpers instead of constant-time cryptographic comparison functions. Two authentication flows are affected in internal/sbi/processor/ueauthentication.go: 1. 5G-AKA confirmation compares RES and XRES with strings.EqualFold(). 2. EAP-AKA' confirmation compares ATMAC with bytes.Equal() and compares XRES and RES with ==. These functions are not designed to be constant-time cryptographic comparators and may return earlier depending on the location of the first mismatch. Additionally, the 5G-AKA confirmation path logs both the received res and the expected Xres at INFO level immediately before comparing them. The XRES value is authentication material and should not be written to application logs. The timing side channel was confirmed as a code issue, but practical exploitation over HTTP was not demonstrated in the lab because the comparator-level signal is much smaller than HTTP/SBI noise.…
Recommended action: Upgrade to 1.4.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\x00) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go's net/url.Parse() to fail, returning HTTP 500 "System failure" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale—4.1% of specialchars mutations produce HTTP 500—causing denial of service for all subscribers attempting authentication through the affected AUSF. CWE-20 (Improper Input Validation). --- Details The vulnerability lies in the AUSF's POST /nausf-auth/v1/ue-authentications handler. The JSON body includes a supiOrSuci field: The AUSF parses this JSON (Go's encoding/json accepts null bytes in strings per RFC 8259), then constructs a UDM URL by directly embedding the raw supiOrSuci value: When supiOrSuci contains null bytes (\x00), the resulting URL is illegal…
Recommended action: Upgrade to 1.4.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact This is an Improper Null Check vulnerability leading to Denial of Service. - Security Impact: A remote attacker can cause the AUSF service to panic and crash by sending a crafted UE authentication request that triggers a nil interface conversion in the GetSupiFromSuciSupiMap function. This results in complete denial of service for the AUSF authentication service. - Functional Impact: The GetSupiFromSuciSupiMap function attempts to perform an interface conversion from interface{} to context.SuciSupiMap without checking if the underlying value is nil. When SuciSupiMap is nil, the code panics with "interface conversion: interface {} is nil, not context.SuciSupiMap". - Affected Parties: All deployments of free5GC v4.0.1 using the AUSF UE authentication service (/nausf-auth/v1/ue-authentications endpoint). Patches Yes, the issue has been patched. The fix is implemented in PR free5gc/ausf#52 (commit: [add specific commit hash if available]). Users should upgrade to the next release…
Recommended action: Upgrade to 1.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.