CVE-2023-47347
📋 TL;DR
A buffer overflow vulnerability in free5gc 3.3.0 allows attackers to cause denial of service by sending specially crafted PFCP messages with manipulated sequence numbers. This affects organizations running vulnerable versions of free5gc, an open-source 5G core network implementation.
💻 Affected Systems
- free5gc
📦 What is this software?
Free5gc by Free5gc
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of the 5G core network functions, potentially affecting all connected devices and services.
Likely Case
Service instability or crashes of affected free5gc components, leading to partial network outages.
If Mitigated
Minimal impact if proper network segmentation and monitoring are in place to detect and block malicious PFCP traffic.
🎯 Exploit Status
Exploitation requires sending crafted PFCP messages to vulnerable interfaces, which is straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 3.3.0
Vendor Advisory: https://github.com/free5gc/free5gc/issues/496
Restart Required: Yes
Instructions:
1. Update free5gc to the latest version. 2. Restart all free5gc services. 3. Verify PFCP functionality is working correctly.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to PFCP interfaces using firewall rules to only trusted sources.
iptables -A INPUT -p udp --dport 8805 -s trusted_ip_range -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit who can send PFCP messages to vulnerable systems.
- Deploy intrusion detection systems to monitor for anomalous PFCP traffic patterns.
🔍 How to Verify
Check if Vulnerable:
Check free5gc version: grep -i version /path/to/free5gc/config/files or check deployment manifests.Check Version:
free5gc version or check package manager (e.g., dpkg -l | grep free5gc)Verify Fix Applied:
Confirm free5gc version is updated beyond 3.3.0 and monitor system logs for stability.📡 Detection & Monitoring
Log Indicators:
- Unexpected process crashes
- Memory allocation errors in free5gc logs
- PFCP protocol errors
Network Indicators:
- Unusual volume of PFCP messages from single sources
- PFCP messages with abnormal sequence numbers
SIEM Query:
source="free5gc" AND ("crash" OR "segmentation fault" OR "buffer overflow")