free5GC AMF: missing 565TD length check in NAS decoder causes AMF crash DoS

Vulnerability Summary Overview Title: [Bugs] NAS decoder fails to properly validate the length of 565TD information elements Type: Bug (Closed, labeled ) Root Cause: In the and functions, the NAS message decoder does not perform boundary checks on the length of 565TD information elements. An attacker can send an where the declared length of the 565TD IE does not match its actual content (e.g., declared length is 5, but the content is longer). This causes the AMF's NAS parser to trigger an "index out of range" panic during parsing, leading to an immediate crash of the AMF process, resulting in a complete Denial of Service (DoS). Impact Scope Affected Components: The AMF module in free5GC (NAS decoder) Trigger Condition: A maliciously constructed NAS message (where the 565TD IE length field in has been tampered with) Consequence: AMF process crash → Complete DoS Environment: free5GC v4.0.1, Ubuntu 20.04, Go 1.21.8 Reproduction Key Points Modify the length field of the 565TD IE in the NAS PDU from the correct value of 13 to an incorrect value of 5, while leaving the rest of the content unchanged, which will trigger the panic. Fix Proposal Add boundary checks for the length of 565TD information elements in the NAS decoder to ensure that the declared length matches the actual content, thereby avoiding out-of-bounds access. Related PR: (prevents panic in under malformed input) POC / Exploit Code No standalone POC code block is provided in the page, but an example of the NAS message that triggers the panic is given in JSON format: ```json {"InitialMessage": {"critically": "ignore", "procedureCode": "value": {"protocolId": {"critically": "reject", "rf": 85, "value": 1804289333}, "critically": "reject", "rf": 38, "value": "F_NAS_565TD_SMFRegistrationRequest": {"SMFHeader": {"EPC": 120, "spare": 0, "565HDR": 0}, "Type": "INITIAL", "NAS_KSI": "NAS_KSI": {"565Header": {"EPC": 1, "spare": 0, "565HDR": 0}, "565TD": {"l": 5}, "spare": 0, "Type": 0, "spare": 0, "Type": 0, "spare": {"SMF": "565HDR": "565HDR", "EPC": 120, "spare": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "565HDR": 0, "

Goal Reached Thanks to every supporter — we hit 100%!

free5GC AMF: missing 565TD length check in NAS decoder causes AMF crash DoS

More from this source