Executive brief
free5GC's AUSF (Authentication Server Function) component handles 5G network user authentication using cryptographic protocols. The component compares authentication response values using non-constant-time comparison functions and logs sensitive authentication credentials (XRES*) to application logs. While timing attacks over the network were not practically demonstrated in testing, the direct exposure of authentication material in logs creates a risk if logs are accessible to operators, infrastructure systems, or log aggregation platforms.
Technical details
The vulnerability consists of two issues in `internal/sbi/processor/ue_authentication.go`. First, the 5G-AKA authentication confirmation path uses `strings.EqualFold()` to compare RES* and XRES* values—a non-constant-time string comparison that may return early on mismatch. More critically, XRES* (the expected authentication response) is logged at INFO level immediately before comparison, exposing authentication material to any process or system with log access. Second, the EAP-AKA' confirmation path uses `bytes.Equal()` and string `==` comparison for MAC and response values instead of `crypto/subtle.ConstantTimeCompare()`. Lab testing confirmed that timing signal at the comparator level is masked by HTTP/SBI network noise, making remote timing attacks impractical. However, local CPU benchmarks show the non-constant-time behavior is real (0.31 ns delta), and the logging of XRES* is directly observable and exploitable. Fixed in v1.4.5 with constant-time comparisons and removal of sensitive values from logs.
Affected products
- go github.com/free5gc/ausf
Timeline
- 2026-06-22: disclosed: GitHub Advisory published
- 2026-06-22: patched: v1.4.5 released with fix
- 2026-08-28: advisory