CVE-2023-47346
📋 TL;DR
A buffer overflow vulnerability in free5gc's UPF and SMF components allows attackers to cause denial of service by sending specially crafted PFCP messages. This affects organizations running vulnerable versions of free5gc, particularly those with internet-facing 5G core network functions.
💻 Affected Systems
- free5gc UPF
- free5gc SMF
📦 What is this software?
Free5gc by Free5gc
Smf by Free5gc
Upf by Free5gc
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of 5G core network functions leading to widespread connectivity loss for mobile users.
Likely Case
Targeted denial of service against specific network functions causing localized service degradation.
If Mitigated
Limited impact with proper network segmentation and monitoring in place.
🎯 Exploit Status
Exploitation requires crafting valid PFCP messages but no authentication is needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check GitHub issues for specific fixes
Vendor Advisory: https://github.com/free5gc/free5gc/issues/482
Restart Required: Yes
Instructions:
1. Check GitHub issue #482 for patches 2. Apply relevant code fixes 3. Rebuild affected components 4. Restart UPF and SMF services
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict PFCP traffic to trusted sources only
iptables -A INPUT -p udp --dport 8805 -s trusted_ip_range -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP
🧯 If You Can't Patch
- Implement strict network ACLs to limit PFCP traffic sources
- Deploy intrusion detection systems to monitor for anomalous PFCP traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check free5gc version and component versions against affected versionsCheck Version:
Check free5gc documentation for version commands specific to your deploymentVerify Fix Applied:
Verify applied patches from GitHub issue and test with normal PFCP traffic📡 Detection & Monitoring
Log Indicators:
- Unusual PFCP message sizes
- Service crashes/restarts of UPF/SMF
- Memory allocation errors
Network Indicators:
- Abnormally large PFCP packets
- PFCP traffic from unexpected sources
- High rate of PFCP association requests
SIEM Query:
source="free5gc" AND ("crash" OR "segfault" OR "buffer overflow")