An unauthenticated remote attacker can trigger a denial of service condition in the free5GC UPF by sending a crafted packet, causing the service to crash.

This is a denial of service vulnerability caused by a lack of bounds checking on the SEID parameter, which results in an integer underflow during processing in the LocalNode.DeleteSess() function. The vulnerability is exploitable by an unauthenticated remote attacker.

The exploitation of this vulnerability results in a service crash, leading to a denial of service for the User Plane Function. In a 5G core network environment, this outage impacts connectivity and data traffic for all associated users, representing a significant operational risk. Given the CVSS score of 7.5, this high severity flaw warrants immediate attention to maintain network availability.

Immediate Action: Since a specific patch is currently unknown, administrators should restrict network access to the UPF interface to trusted sources only, preventing unauthorized remote access.

Proactive Monitoring: Monitor system logs for repeated Go runtime panics or crashes related to the PFCP session management module.

Compensating Controls: Implement firewall rules to inspect and validate PFCP packets, specifically targeting and dropping requests containing malformed or excessively large SEID values.

Public Exploit Available: Unknown.

This vulnerability presents a high risk to network stability due to the ease of triggering a crash without requiring authentication. Organizations utilizing free5GC should monitor the official project repository for upcoming security patches and apply them immediately upon release. In the interim, strictly enforcing network segmentation around the UPF is the most effective method to mitigate exposure.