-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/free5gc/udm | go | <= 1.4.0 | |
| github.com/free5gc/openapi | go | < 1.2.2 | 1.2.2 |
Miggo AIRoot Cause AnalysisThe vulnerability consists of multiple Denial of Service vectors within the Free5GC UDM's Nudm_SubscriberDataManagement API. The root cause across all identified functions is a failure to properly validate and handle user-controllable input. Specifically:
Index Out of Range Panic: In Server.HandleGetSharedData, the code directly accessed an element from a slice populated by a URL query parameter (supported-features) without first checking if the slice was empty. An attacker could omit this parameter, causing an 'index out of range' panic that crashes the service.
Improper Input Unmarshalling: In Processor.GetSmDataProcedure, the single-nssai parameter was unmarshalled from JSON without adequate error handling. A malformed JSON string would cause an unhandled error, resulting in a panic and service termination.
Missing Input Validation: In Processor.SubscribeToSharedDataProcedure, the NfInstanceId field was used without being validated for presence or correct format (UUID). A missing or invalid ID would lead to an internal server error and crash, as downstream logic likely depends on a valid ID.
In all cases, an attacker with network access to the API could send specially crafted requests to trigger these conditions, causing the UDM process to crash and resulting in a Denial of Service.
Server.HandleGetSharedDatainternal/sbi/api_subscriberdatamanagement.go
Processor.GetSmDataProcedureinternal/sbi/processor/subscriber_data_management.go
Processor.SubscribeToSharedDataProcedureinternal/sbi/processor/subscriber_data_management.go