Description

A vulnerability was determined in Free5GC up to 4.2.3. This vulnerability affects unknown code of the file /corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handler.go of the component Gmm Handler. This manipulation causes race condition. The attack can be initiated remotely. Patch name: e323b01464355781b8b8d5dd695e05cbc00a62f2. To fix this issue, it is recommended to deploy a patch.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-20T19:17:12.780Z",
  "pubdate": "2026-09-20T19:17:12.780Z",
  "executiveSummary": "A race condition vulnerability has been identified within the Gmm Handler component of Free5GC, specifically affecting versions up to 4.2.3.\nThis vulnerability resides in the file /corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handler.go and allows for remote exploitation by an attacker.\nThe flaw stems from improper synchronization when handling concurrent operations, potentially leading to inconsistent application states or memory corruption.\nThe risk implication is significant, as the vulnerability affects a critical component (AMF) within the 5G core network, which could lead to denial-of-service (DoS) conditions or potential security bypasses.\nSuccessful exploitation requires the attacker to have network reachability to the AMF, enabling remote initiation of the race condition.\nThe vulnerability is addressed via patch identifier e323b01464355781b8b8d5dd695e05cbc00a62f2, and immediate remediation is advised for all affected deployments.",
  "technicalDetails": "The vulnerability is a race condition located within the Gmm Handler of the Access and Mobility Management Function (AMF) in Free5GC, specifically within the source code file /corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handler.go.\nA race condition occurs when a system attempts to perform two or more operations concurrently, but the final outcome depends on the specific order or timing of execution. In the context of the AMF Gmm Handler, the implementation fails to adequately protect shared resources or state transitions from interleaved access by multiple concurrent requests.\nThe attack flow involves an attacker sending specially crafted or rapid-fire GMM (5G Mobility Management) signaling messages to the AMF. By exploiting the lack of proper mutex locking or atomic operations within the handler, the attacker induces a state where concurrent threads modify the same internal data structure or session state simultaneously.\nThe root cause is a failure in the synchronization logic within the handler's execution path. When the AMF receives GMM messages that trigger state transitions, the handler does not ensure that these transitions are atomic. If multiple threads attempt to update the GMM state machine or related session contexts at the same time, the internal memory representation can become corrupted or fall into an undefined state.\nExploitation is initiated remotely over the network, as the Gmm Handler processes messages from User Equipment (UE). An attacker does not necessarily require high-level privileges to initiate the signaling that triggers the vulnerability, provided they can reach the AMF over the N1/N2 interface protocols.\nThe impact of this vulnerability is severe due to the critical nature of the AMF. Successful exploitation could force the AMF into a crash (leading to a DoS for all UEs attached to that AMF) or potentially manipulate session contexts. Because the race condition involves shared state, it could theoretically lead to improper authentication bypass or unauthorized access if the state machine logic is subverted during a critical signaling sequence.\nThe vulnerability affects all Free5GC versions up to 4.2.3. The provided patch e323b01464355781b8b8d5dd695e05cbc00a62f2 addresses the defect by likely implementing appropriate synchronization primitives, such as mutexes, read-write locks, or atomic operations, to ensure thread-safe handling of concurrent signaling events within the Gmm handler logic."
}