CVE-2023-46324
📋 TL;DR
This vulnerability in free5GC UDM allows an invalid curve attack when using Go versions before 1.19. An attacker can send arbitrary SUCIs (Subscription Concealed Identifiers) to the UDM, which then attempts decryption using both its private key and the attacker's public key without proper validation. This affects free5GC UDM deployments running vulnerable versions with Go <1.19.
💻 Affected Systems
- free5GC UDM
📦 What is this software?
Udm by Free5gc
⚠️ Risk & Real-World Impact
Worst Case
Private key compromise leading to decryption of sensitive subscriber data, authentication bypass, and potential 5G network compromise.
Likely Case
Information disclosure of subscriber identifiers and potential denial of service through resource exhaustion.
If Mitigated
Limited impact with proper network segmentation and monitoring, though risk remains if vulnerable components are exposed.
🎯 Exploit Status
Attack requires sending specially crafted SUCIs to the UDM endpoint. The vulnerability is well-documented with technical details available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.0
Vendor Advisory: https://github.com/free5gc/udm/pull/20
Restart Required: Yes
Instructions:
1. Update free5GC UDM to version 1.2.0 or later. 2. Ensure Go version 1.19 or later is installed. 3. Restart the UDM service.
🔧 Temporary Workarounds
Upgrade Go Runtime
linuxUpdate Go to version 1.19 or later which includes fixes for elliptic curve validation.
go version
sudo apt-get update && sudo apt-get install golang-1.19
Network Segmentation
allRestrict access to UDM SUCIs endpoints to trusted networks only.
🧯 If You Can't Patch
- Implement strict network access controls to limit UDM exposure to untrusted networks.
- Deploy intrusion detection systems to monitor for anomalous SUCIs traffic patterns.
🔍 How to Verify
Check if Vulnerable:
Check UDM version and Go version: 1. Verify UDM version <1.2.0. 2. Verify Go version <1.19.Check Version:
udm --version && go versionVerify Fix Applied:
Confirm UDM version >=1.2.0 and Go version >=1.19 are installed and running.📡 Detection & Monitoring
Log Indicators:
- Unusual volume of SUCIs decryption requests
- Failed decryption attempts with malformed public keys
- Errors in suci.go related to elliptic curve operations
Network Indicators:
- High frequency of SUCIs messages to UDM endpoints
- Unusual source IPs sending SUCIs requests
SIEM Query:
source="udm.log" AND ("SUCI" OR "decryption" OR "elliptic") AND ("error" OR "failed" OR "invalid")🔗 References
- https://github.com/free5gc/udm/compare/v1.1.1...v1.2.0
- https://github.com/free5gc/udm/pull/20
- https://www.gsma.com/security/wp-content/uploads/2023/10/0073-invalid_curve.pdf
- https://github.com/free5gc/udm/compare/v1.1.1...v1.2.0
- https://github.com/free5gc/udm/pull/20
- https://www.gsma.com/security/wp-content/uploads/2023/10/0073-invalid_curve.pdf
