Executive brief
Free5GC is an open-source implementation of a 5G core network. A race condition in the AMF (Access and Mobility Management Function) component allows an attacker to exploit concurrent access to RanUe context data, potentially causing service disruption or data inconsistency in 5G authentication and mobility management. The vulnerability is triggered by network-based access without requiring authentication.
Technical details
The vulnerability is a race condition in the GMM handler's RanUe context management within Free5GC's AMF component. The RanUe map was accessed without proper synchronization (mutex protection), allowing concurrent read/write operations to corrupt shared state. The fix adds a sync.RWMutex (ranUeMu) to serialize access to the RanUe context map, eliminating the data race.
Affected products
- Free5GC Free5GC up to 4.2.3
Timeline
- 2026-09-20: disclosed
- 2026-08-27: patched: Commit e323b01 merged