A heap buffer overflow vulnerability in free5GC v4.0.1 allows remote unauthenticated attackers to trigger a service crash, resulting in a critical denial of service.

This is a heap buffer overflow vulnerability located in the SDFFilterFields.UnmarshalBinary function within the sdf-filter.go file. The vulnerability is triggered when the component processes a declared length that exceeds the actual buffer capacity, which can be initiated by an unauthenticated remote attacker.

The successful exploitation of this vulnerability results in a runtime panic and subsequent crash of the User Plane Function (UPF) component. Given that the UPF is a critical element for data traffic handling in 5G core networks, this denial of service condition can lead to significant network outages and loss of connectivity for downstream subscribers. With a CVSS score of 7.5, the impact is considered high due to the potential for remote disruption without requiring authentication.

Immediate Action: Review the official free5GC repository issue tracker for available patches or configuration workarounds, and prioritize upgrading from version 4.0.1 if a fix is released.

Proactive Monitoring: Monitor network infrastructure logs for abnormal PFCP traffic patterns, specifically focusing on malformed Session Modification Requests directed at the UPF.

Compensating Controls: Implement strict network access control lists (ACLs) to limit the sources capable of communicating with the UPF via the PFCP protocol, effectively reducing the attack surface.

Public Exploit Available: Unknown

Organizations utilizing free5GC v4.0.1 should immediately evaluate the necessity of the UPF exposure to external network segments and apply restrictive firewall policies. Until a vendor-supplied patch is verified, continuous monitoring of UPF stability is essential to maintain service availability. Prioritize this remediation due to the ease of reachability and the critical nature of the affected component.