{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3afree5gcausf/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:free5gc:ausf:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-55784"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AUSF (\u003c= 1.4.4)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","free5gc","5g-security"],"_cs_type":"advisory","_cs_vendors":["free5GC"],"content_html":"\u003cp\u003eThe free5GC AUSF component (v1.4.4 and earlier) is vulnerable to a race condition that allows an attacker to selectively disrupt 5G authentication procedures for specific subscribers. The vulnerability stems from the use of a global \u003ccode\u003esync.Map\u003c/code\u003e to store \u003ccode\u003eAusfUeContext\u003c/code\u003e objects, where the subscriber's Permanent Identifier (SUPI) serves as the sole lookup key. The implementation lacks logic to detect concurrent authentication sessions for the same subscriber, allowing subsequent requests to unconditionally overwrite existing contexts.\u003c/p\u003e\n\u003cp\u003eAn attacker with network-level access to the Service Based Architecture (SBA) or the SBI/N12 interface can flood the AUSF with concurrent \u003ccode\u003ePOST /nausf-auth/v1/ue-authentications\u003c/code\u003e requests for a targeted SUPI. By replacing the active authentication context mid-procedure, the attacker ensures that the legitimate EAP-AKA' response from the user is validated against mismatched session material (specifically \u003ccode\u003eK_aut\u003c/code\u003e and \u003ccode\u003eXRES\u003c/code\u003e). This causes integrity check failures and prevents the subscriber from completing authentication, effectively denying the service to the target.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe legitimate subscriber initiates a 5G authentication procedure.\u003c/li\u003e\n\u003cli\u003eThe AUSF processes the initial request and stores the authentication context (\u003ccode\u003ectx_LEGIT\u003c/code\u003e) in the global \u003ccode\u003eUePool\u003c/code\u003e map under the target's SUPI key.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies a target SUPI/SUCI and initiates a flood of concurrent \u003ccode\u003ePOST /nausf-auth/v1/ue-authentications\u003c/code\u003e requests for that same identity.\u003c/li\u003e\n\u003cli\u003eEach malicious request causes the AUSF to overwrite the previous entry in the \u003ccode\u003eUePool\u003c/code\u003e map with a new context (\u003ccode\u003ectx_ATTACK\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe target subscriber receives an authentication challenge and computes a valid EAP-AKA' response based on \u003ccode\u003ectx_LEGIT\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe subscriber transmits the response to the AUSF \u003ccode\u003e/eap-session\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe AUSF retrieves the current (overwritten) context (\u003ccode\u003ectx_ATTACK\u003c/code\u003e) from the map.\u003c/li\u003e\n\u003cli\u003eThe integrity check (AT_MAC verification) fails because the response was signed using parameters from \u003ccode\u003ectx_LEGIT\u003c/code\u003e while the AUSF validates against \u003ccode\u003ectx_ATTACK\u003c/code\u003e, resulting in a service denial.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a targeted denial of authentication service for any selected subscriber in a 5G network running vulnerable versions of free5GC. While the AUSF service remains operational and no sensitive authentication material is leaked, the impacted subscriber is unable to connect to the network as long as the attacker maintains the request flood. The scope of impact is limited to those with direct or proxied access to the AUSF internal SBI/N12 interface.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade free5GC AUSF to a version that addresses the context management vulnerability (patch status for v1.4.4+).\u003c/li\u003e\n\u003cli\u003eImplement a unique session identifier in the \u003ccode\u003eAusfUeContext\u003c/code\u003e and ensure authentication state lookups use this identifier rather than the SUPI.\u003c/li\u003e\n\u003cli\u003eDeploy logic to check for ongoing authentication procedures for a specific SUPI and reject concurrent attempts with \u003ccode\u003eHTTP 409 Conflict\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eEnforce strict mTLS and OAuth2 requirements on all internal SBI traffic to prevent unauthorized access to the AUSF interface.\u003c/li\u003e\n\u003cli\u003eEnable rate limiting on authentication request endpoints to mitigate the impact of flooding attacks.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-29T03:13:51Z","date_published":"2026-08-29T03:13:51Z","id":"https://feed.craftedsignal.io/briefs/2026-08-free5gc-ausf-race/","summary":"An authentication state race condition in free5GC AUSF allows an attacker to perform a targeted denial-of-service by overwriting authentication contexts keyed by SUPI, preventing successful subscriber authentication.","title":"Race Condition in free5GC AUSF Authentication Context","url":"https://feed.craftedsignal.io/briefs/2026-08-free5gc-ausf-race/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:free5gc:ausf:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}