Advisories for Golang/Github.com/Free5gc/Ausf package

The AUSF component of free5GC compares authentication response values with normal Go equality helpers instead of constant-time cryptographic comparison functions. Two authentication flows are affected in internal/sbi/processor/ue_authentication.go: 5G-AKA confirmation compares RES* and XRES* with strings.EqualFold(). EAP-AKA' confirmation compares AT_MAC with bytes.Equal() and compares XRES and RES with ==. These functions are not designed to be constant-time cryptographic comparators and may return earlier depending on the location of the first mismatch. …

The AUSF component of free5GC stores per-subscriber authentication state in a global sync.Map keyed only by SUPI. Every incoming authentication request creates a new AusfUeContext and stores it under that SUPI key without checking whether an authentication procedure is already in progress and without generating a per-session unique identifier. An attacker with access to the AUSF SBI/N12 interface can send concurrent POST /nausf-auth/v1/ue-authentications requests for the same target SUPI. Each …

The free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\x00) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go's net/url.Parse() to fail, returning HTTP 500 "System failure" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale—4.1% of special_chars mutations produce HTTP 500—causing denial …

Impact This is an Improper Null Check vulnerability leading to Denial of Service. Security Impact: A remote attacker can cause the AUSF service to panic and crash by sending a crafted UE authentication request that triggers a nil interface conversion in the GetSupiFromSuciSupiMap function. This results in complete denial of service for the AUSF authentication service. Functional Impact: The GetSupiFromSuciSupiMap function attempts to perform an interface conversion from interface{} to …