CVE-2025-70122
📋 TL;DR
A heap buffer overflow vulnerability in free5GC's UPF component allows remote attackers to crash the UPF service via specially crafted PFCP Session Modification Requests. This causes denial of service for 5G core network functions. Organizations running free5GC v4.0.1 in production are affected.
💻 Affected Systems
- free5GC
📦 What is this software?
Free5gc by Free5gc
⚠️ Risk & Real-World Impact
Worst Case
Complete UPF service crash leading to loss of user plane connectivity, disrupting 5G data services for all connected devices until service restart.
Likely Case
Targeted DoS attacks causing intermittent UPF crashes and service disruption, requiring manual intervention to restore functionality.
If Mitigated
Limited impact with proper network segmentation and monitoring, allowing quick detection and recovery from crashes.
🎯 Exploit Status
Exploitation requires PFCP protocol knowledge and ability to send crafted packets to UPF interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v4.0.2 or later
Vendor Advisory: https://github.com/free5gc/free5gc/issues/746
Restart Required: No
Instructions:
1. Update free5GC to v4.0.2 or later. 2. Replace affected sdf-filter.go file with patched version. 3. Restart UPF service to apply changes.
🔧 Temporary Workarounds
Network Segmentation
LinuxRestrict PFCP traffic to trusted N4 interfaces only using firewall rules.
iptables -A INPUT -p udp --dport 8805 -s <trusted_smf_ip> -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP
🧯 If You Can't Patch
- Implement strict network ACLs to limit PFCP traffic sources to authorized SMF nodes only.
- Deploy UPF redundancy with load balancing to maintain service during individual instance crashes.
🔍 How to Verify
Check if Vulnerable:
Check free5GC version: free5gc version | grep 'v4.0.1'Check Version:
free5gc versionVerify Fix Applied:
Verify version is v4.0.2 or later: free5gc version | grep -v 'v4.0.1'📡 Detection & Monitoring
Log Indicators:
- UPF panic logs containing 'SDFFilterFields.UnmarshalBinary'
- UPF process crashes with heap overflow errors
- Repeated UPF service restarts
Network Indicators:
- Unusual PFCP Session Modification Requests from untrusted sources
- Spike in malformed PFCP packets to port 8805
SIEM Query:
source="free5gc.log" AND "panic" AND "SDFFilterFields"