free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

Summary

The AUSF component of free5GC stores per-subscriber authentication state in a global sync.Map keyed only by SUPI. Every incoming authentication request creates a new AusfUeContext and stores it under that SUPI key without checking whether an authentication procedure is already in progress and without generating a per-session unique identifier.

An attacker with access to the AUSF SBI/N12 interface can send concurrent POST /nausf-auth/v1/ue-authentications requests for the same target SUPI. Each request is accepted and overwrites the previous authentication context. A valid EAP-AKA' response for an earlier challenge is then verified against the latest overwritten context, whose K_aut, XRES, and EapID no longer match the challenge. The result is a targeted authentication denial of service for that SUPI while the request flood is maintained.

This issue was confirmed on github.com/free5gc/ausf v1.4.4 and current main as of June 2026.

Details

The vulnerable context pool is defined in internal/context/context.go.

UePool is a sync.Map, which makes individual map operations safe, but it does not make the authentication procedure state safe. The problem is the session design: the key is only the SUPI, and Store() unconditionally replaces any active context for that SUPI.

type AUSFContext struct {
    suciSupiMap sync.Map
    UePool      sync.Map
    // ...
}

type AusfUeContext struct {
    Supi string
    // ...

    // for EAP-AKA'
    K_aut    string
    XRES     string
    Rand     string
    EapID    uint8
    Resynced bool
}

func NewAusfUeContext(identifier string) (ausfUeContext *AusfUeContext) {
    ausfUeContext = new(AusfUeContext)
    ausfUeContext.Supi = identifier
    return ausfUeContext
}

func AddAusfUeContextToPool(ausfUeContext *AusfUeContext) {
    ausfContext.UePool.Store(ausfUeContext.Supi, ausfUeContext)
}