A critical race condition vulnerability in the free5GC AUSF component enables unauthenticated attackers to perform a targeted denial of service against network subscribers.

The flaw is a race condition (CWE-362) within the AUSF component where subscriber authentication state is stored in a global map keyed only by SUPI. Unauthenticated attackers can overwrite the authentication context by sending concurrent requests to the SBI/N12 interface, causing authentication failures for targeted users.

This vulnerability poses a significant risk to the availability of telecommunications services. By successfully exploiting this race condition, an attacker can prevent legitimate subscribers from authenticating to the 5G core network, resulting in a targeted denial of service. With a CVSS score of 7.5, the vulnerability represents a high-severity risk that could lead to widespread service disruption and reputational damage for network operators.

Immediate Action: As no fixed version is currently available, administrators should restrict access to the AUSF SBI/N12 interface to authorized network elements only.

Proactive Monitoring: Monitor network logs for a high volume of concurrent POST requests to the /nausf-auth/v1/ue-authentications endpoint originating from unexpected or untrusted sources.

Compensating Controls: Implement rate limiting and strict ingress filtering on the AUSF interface to mitigate the potential for high-frequency request floods.

Public Exploit Available: Unknown

Given the high impact on network service availability, organizations utilizing free5GC must prioritize the isolation of the affected AUSF interface from external or untrusted network segments. While a patch is currently unavailable, implementing rigorous access controls and monitoring for anomalous traffic patterns is essential to mitigate the risk of a denial of service attack until a vendor-supplied update is released.