CVE-2023-49391: free5GC AMF Denial of Service Vulnerability
Summary
CVE-2023-49391: free5GC AMF denial of service vulnerability. Affects github.com/free5gc/amf versions < 1.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The free5GC AMF package is a component of the free5GC open-source project written in Go. It is responsible for managing the Access and Mobility Management function in 5G networks. The AMF component handles various network procedures and protocols, including the Next Generation Application Protocol (NGAP).
Vulnerability Detail
The discovered vulnerability in free5GC version 3.3.0 allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on the AMF component. This can be achieved by sending crafted NGAP messages to the AMF. The vulnerability poses a significant risk as it can lead to the compromise of the AMF and disrupt the functionality of the 5G network.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no known workarounds exist for this vulnerability. It is crucial to apply the recommended fix by upgrading to a non-vulnerable version of free5GC.
Conclusion
The free5GC AMF package is vulnerable to a denial of service vulnerability that allows remote attackers to execute arbitrary code. Upgrading to a non-vulnerable version of free5GC is the recommended solution. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/free5gc/amf →
FAQ
free5GC is an open-source project that aims to provide a complete 5G Core Network implementation. It includes various components, such as the AMF, SMF, UPF, and more.
The AMF (Access and Mobility Management Function) is responsible for managing the mobility and access of devices in a 5G network. It handles procedures such as registration, authentication, and mobility management.
The vulnerability allows remote attackers to execute arbitrary code and cause a denial of service on the AMF component. This can lead to the compromise of the AMF and disrupt the functionality of the 5G network.
Yes, upgrading to a version of free5GC beyond 1.2.0 will fix the vulnerability. It is recommended to upgrade to the latest stable release.
No, currently there are no known workarounds for this vulnerability. Upgrading to a non-vulnerable version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/free5gc/amf.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
