Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis of the security patch (commit 7a5a4aa1ec6cd0e1febebf333911c3104968edf0) reveals vulnerabilities in three functions within internal/sbi/processor/ue_authentication.go. The core issues are the use of non-constant-time comparison functions for cryptographic secrets and the logging of sensitive authentication data.
Processor.EapAuthComfirmRequestProcedure: This function used bytes.Equal and a direct string comparison (==) for authentication checks. These operations can terminate early upon finding a mismatch, creating a timing difference that could be exploited by a remote attacker to guess secret values byte by byte.
Processor.UeAuthPostRequestProcedure: This function logged the XresStar value, which is a key piece of authentication material in the 5G-AKA protocol. Exposing this in logs creates a significant information disclosure risk.
Processor.Auth5gAkaComfirmRequestProcedure: This function suffered from both issues. It logged both the received res* and the expected Xres* before comparison, and then used strings.EqualFold for the check. This both leaks the secret in logs and introduces a timing side-channel.
The patch remediates these issues by removing the logging statements and replacing the insecure comparison functions with constant-time equivalents (subtle.ConstantTimeCompare), which take the same amount of time to execute regardless of whether the inputs match. The identified functions are the ones directly responsible for handling the vulnerable authentication logic and processing the sensitive inputs.
Processor.EapAuthComfirmRequestProcedureinternal/sbi/processor/ue_authentication.go
Processor.UeAuthPostRequestProcedureinternal/sbi/processor/ue_authentication.go
Processor.Auth5gAkaComfirmRequestProcedureinternal/sbi/processor/ue_authentication.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/free5gc/ausf | go | < 1.4.5 | 1.4.5 |