Description

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ue_authentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES* and XRES* with strings.EqualFold and logs the expected XRES* value at INFO level before comparison. EapAuthComfirmRequestProcedure compares AT_MAC and XMAC with bytes.Equal and evaluates XRES == RES with ordinary string equality. These comparisons can return at mismatch-dependent times, although testing did not demonstrate a practical remote timing oracle because of HTTP/SBI timing noise. The INFO log exposes authentication material to operators, log collectors, sidecars, or processes able to read AUSF logs. This issue is fixed in version 1.4.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-28T23:17:07.697Z",
  "pubdate": "2026-08-28T23:17:07.697Z",
  "executiveSummary": "The AUSF component of free5GC prior to version 1.4.5 is susceptible to sensitive information disclosure and potential timing-based side-channel vulnerabilities during 5G AKA and EAP-AKA authentication procedures.\nThe vulnerability stems from the use of non-constant-time comparison functions for cryptographic authentication tokens and the inadvertent logging of sensitive expected authentication values.\nThe exposure of authentication material (XRES*) via INFO-level logs allows unauthorized entities with access to log management systems, sidecars, or file-system-level monitoring to intercept cryptographic secrets.\nWhile the comparison mechanisms are technically non-constant-time, the impact is primarily centered on credential exposure, as HTTP/SBI protocol overhead introduces significant jitter that complicates remote exploitation of timing oracles.\nThis issue affects the internal/sbi/processor/ue_authentication.go module, and immediate remediation through version 1.4.5 is required to secure the authentication handshake and sanitize logging practices.",
  "technicalDetails": "The vulnerability resides within the AUSF (Authentication Server Function) component, specifically in the processing logic for 5G AKA and EAP-AKA authentication procedures found in internal/sbi/processor/ue_authentication.go.\nRoot Cause: The authentication verification routines utilize insecure comparison methods. In Auth5gAkaComfirmRequestProcedure, the system compares RES* and XRES* values using strings.EqualFold. In EapAuthComfirmRequestProcedure, the system utilizes bytes.Equal for AT_MAC verification and standard string equality for XRES/RES validation. These functions do not provide constant-time execution, which theoretically allows for timing side-channel attacks by measuring the duration of the comparison operations to deduce bitwise differences in the authentication tokens.\nInformation Disclosure via Logging: Beyond the potential for timing analysis, the system exhibits critical insecure logging practices. During the Auth5gAkaComfirmRequestProcedure, the AUSF component explicitly logs the expected XRES* value at the INFO level. This practice persists throughout the authentication flow, resulting in the writing of sensitive cryptographic material to persistent log storage.\nAttack Flow: An attacker or a malicious actor with read access to the infrastructure's logging pipeline (e.g., centralized log collectors, log-forwarding sidecars, or local file access) can extract the XRES* values associated with active or past authentication sessions. By obtaining these values, an attacker can bypass subsequent authentication checks or perform relay attacks if the session state allows.\nExploitation Challenges: While the lack of constant-time comparisons technically constitutes a flaw, the feasibility of a remote timing oracle is significantly mitigated by the inherent latency and timing noise associated with the HTTP/SBI (Service Based Interface) protocol. The fluctuation in round-trip times makes precise measurements of the comparison duration difficult, though the logging vulnerability remains a deterministic and highly exploitable vector for intelligence gathering.\nImpact: Successful exploitation results in the compromise of sensitive authentication credentials, allowing for potential identity impersonation, unauthorized network access, or the facilitation of advanced persistent threats against the 5G core network architecture."
}