Executive brief
The free5GC AUSF (Authentication Server Function) component manages 5G subscriber authentication. A race condition in how it stores per-subscriber authentication state allows an attacker to block a target subscriber from authenticating by flooding the system with concurrent requests for the same subscriber. During the attack, legitimate authentication attempts fail because the AUSF's stored security material (cryptographic keys and response values) is continuously overwritten by attacker-controlled requests, causing valid authentication responses to fail verification checks.
Technical details
The vulnerability is a race condition in subscriber authentication state management. The AUSF stores authentication context in a sync.Map with SUPI as the sole key; every incoming POST /nausf-auth/v1/ue-authentications request unconditionally replaces any existing context for that SUPI via a Store() call without checking for in-progress authentication or generating a unique session identifier. An attacker with network access to the AUSF SBI or N12 interface can flood concurrent authentication requests targeting the same SUPI. Each request obtains a new authentication vector (including K_aut, XRES, and EapID) and overwrites the stored context. When a legitimate EAP-AKA' response arrives, the AUSF retrieves the current (overwritten) context by SUPI and attempts MAC verification using the attacker-controlled K_aut, causing the authentication to fail even though the response was valid for the original challenge. No patched versions are currently available; the issue affects v1.4.4 and current main as of June 2026. Mitigation requires redesigning the session model to use unique session IDs instead of SUPI as the sole context key, or implementing atomic check-and-insert with explicit rejection of concurrent attempts.
Affected products
- free5gc AUSF <= 1.4.4, current main as of June 2026
Timeline
- 2026-06-22: disclosed: Vulnerability confirmed on free5gc/ausf v1.4.4 and main branch
- 2026-08-28: advisory: GitHub Security Advisory GHSA-334q-h5g3-fpxv published
- 2026-05-27: other: Proof of concept demonstrated in controlled lab environment showing race condition and authentication failure