The free5GC AMF component is vulnerable to a remote denial of service attack that can crash the service via a specifically crafted 5GS Mobile Identity message.

This is an array index out of bounds vulnerability occurring in the GetSUCI method within the NAS_MobileIdentity5GS.go file. An unauthenticated attacker can trigger a runtime panic, resulting in an immediate AMF service crash, by sending a malicious NAS Registration Request.

The AMF is a critical core network function in 5G deployments, responsible for handling connection and mobility management for user equipment. A successful exploit leads to a complete denial of service for the affected AMF, which can disrupt mobile connectivity for all associated users. With a CVSS score of 7.5, this high severity flaw poses a significant risk to network availability and service level agreements.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the official free5GC repository for updates and apply them immediately upon release.

Proactive Monitoring: Monitor AMF logs for frequent runtime panics or unexpected service restarts, and review NAS registration traffic patterns for malformed or suspicious 5GS Mobile Identity parameters.

Compensating Controls: Implement strict network access control lists to limit the exposure of the AMF to trusted sources only, effectively reducing the attack surface for remote, unauthenticated actors.

Public Exploit Available: Unknown.

Given the critical role of the AMF in 5G infrastructure, this vulnerability represents a high risk to operational continuity. Security teams should prioritize limiting exposure of the AMF interface to untrusted networks and prepare to deploy vendor patches as soon as they become available. Constant vigilance regarding the vendor's issue tracker is required to ensure timely remediation.