Free5GC AMF Array Out-of-Bounds Vulnerability (CVE-2025-70121) Analysis and Patch

Key Information Vulnerability Description Vulnerability Type: Array Index Out-of-Bounds Vulnerability Affected Component: Free5GC AMF Component Trigger Condition: Crash occurs when processing a maliciously crafted 5GS Mobile Identity message Severity: Unauthorized attackers can cause a complete denial of service (DoS) on the 5G core network Reproduction Steps 1. Establish an SCTP connection to the AMF NGAP interface 2. Send normal messages 3. Send a packet containing a malicious NAS message 4. Observe AMF crash and crash logs Expected Behavior 1. Proper validation of the 5GS Mobile Identity field and array bounds 2. Reject malicious NAS Registration Request messages with appropriate error handling 3. Continue serving other UEs without service interruption 4. Implement robust boundary checks in the MobileIdentity5GS parsing logic Environment free5GC Version: v4.0.1 Operating System: Ubuntu 22.04 Kernel Version: Not specified Go Version: Not specified Root Cause Analysis 1. Vulnerable code located in in the method 2. Technical Issue: Code attempts to access the 5th element (index 4) of an array that only contains 5 elements (indices 0-4), causing a runtime crash 3. Attack Vector: Modification of the 5GS Mobile Identity field within the InitialUEMessage in a NAS Registration Request 4. Impact: Causes a complete AMF service crash (fatal crash), leading to interruption of 5G core network services; no authentication required to trigger; manual intervention required to restore AMF service Patch Released: Yes Patch Location: Implemented in PR Upgrade Recommendation: Users should upgrade to the next free5GC version that includes this fix Additional Information CVE-2025-70121 has been assigned to this vulnerability

Goal Reached Thanks to every supporter — we hit 100%!

Free5GC AMF Array Out-of-Bounds Vulnerability (CVE-2025-70121) Analysis and Patch

More from this source