Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2022-38871
CVE-2022-38871:
vulnerability analysis and mitigation
Overview
A vulnerability was discovered in free5gc AMF (Access and Mobility Management Function) version 3.0.5 that allows attackers to cause the AMF to crash when processing malformed NAS (Non-Access Stratum) messages. The vulnerability was discovered on April 26, 2021 and tracked as CVE-2022-38871. The issue affects the AMF component when handling malformed NAS messages from 5G subscribers (Free5GC Issue).
Technical details
The vulnerability stems from improper validation of NAS message structures and IEs (Information Elements). When processing malformed NAS messages like empty 5GSID, oversized IE values, or malformed UE Security Capabilities, the AMF crashes due to Go runtime memory errors including index out of range and slice bounds violations. The issue is particularly exposed as it can be triggered by any 5G subscriber sending malformed NAS messages (Free5GC Issue).
Impact
An attacker could leverage this vulnerability to cause excessive downtime and resource consumption against a pool of AMF instances. When exploited, the AMF process crashes and stops responding on the SCTP socket, requiring a restart. In some cases, the process consumes excessive CPU and memory resources until being killed by the Linux kernel (Free5GC Issue).
Mitigation and workarounds
During the NAS message decoding process, proper validation should be implemented to ensure messages are valid. Invalid or malformed messages should be dropped and the corresponding UE context should be deleted. The Go memory runtime provides some protection by catching memory issues, preventing potential exploitable cases (Free5GC Issue).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management