free5GC AUSF Authentication Contexts Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- free5gc (go)
- Patched version
- Not yet available
An early warning has been issued for a vulnerability in the AUSF component of free5GC. This issue could allow an attacker to cause a targeted authentication denial of service.
What happened
The AUSF component of free5GC reportedly stores per-subscriber authentication state in a global sync.Map keyed only by SUPI. Every incoming authentication request creates a new AusfUeContext and stores it under that SUPI key without checking whether an authentication procedure is already in progress. An attacker with access to the AUSF SBI/N12 interface can send concurrent POST /nausf-auth/v1/ue-authentications requests for the same target SUPI, resulting in a targeted authentication denial of service.
This vulnerability affects free5GC versions up to and including v1.4.4 and the main branch. The issue is tracked under GHSA-334q-h5g3-fpxv. It is under investigation and has not been exploited in the wild as of the latest reports.
What to do about it
- Monitor for concurrent authentication requests to detect potential exploitation attempts.
- Consider implementing rate limiting on the AUSF SBI/N12 interface to mitigate the risk of denial of service attacks.
- Review and improve session management practices to ensure that authentication procedures are not inadvertently interrupted.
- Consult the primary sources for the latest updates and recommendations as this issue is under investigation.
How 0Day would have caught this
free5gc is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using free5GC versions up to and including v1.4.4 or the main branch.
What should I do right now?
Monitor for concurrent authentication requests and consider implementing rate limiting or session management improvements.
Is there an official fix available?
No official fix has been published yet. Monitor the sources for updates.