CVE-2025-63679: Free5GC Buffer Overflow Vulnerability

CVE-2025-63679 Overview

CVE-2025-63679 is a Buffer Overflow vulnerability affecting free5gc, an open-source 5G core network implementation. When the Access and Mobility Management Function (AMF) component receives a maliciously crafted UplinkRANConfigurationTransfer NGAP message from a gNB (next-generation Node B), the AMF process crashes, resulting in a denial of service condition. This vulnerability affects free5gc version 4.1.0 and all prior versions.

Critical Impact

Network-exploitable buffer overflow that causes AMF process crashes, disrupting 5G core network operations and potentially affecting all connected mobile devices.

Affected Products

• free5gc version 4.1.0 and earlier
• free5gc AMF (Access and Mobility Management Function) component
• 5G core network deployments utilizing free5gc

Discovery Timeline

• 2025-11-12 - CVE-2025-63679 published to NVD
• 2025-12-31 - Last updated in NVD database

Technical Details for CVE-2025-63679

Vulnerability Analysis

This vulnerability is classified as CWE-120 (Buffer Copy without Checking Size of Input), commonly known as a classic buffer overflow. The flaw exists in how the AMF component processes incoming NGAP (NG Application Protocol) messages from base stations. When parsing an UplinkRANConfigurationTransfer message, the AMF fails to properly validate the size of input data before copying it into a fixed-size buffer, leading to memory corruption and process termination.

The attack can be executed remotely over the network without requiring any authentication or user interaction. While the vulnerability does not directly enable code execution or data exfiltration, the denial of service impact is significant in 5G infrastructure contexts where AMF availability is critical for managing device connections, mobility, and session management across the network.

Root Cause

The root cause is improper bounds checking when processing NGAP UplinkRANConfigurationTransfer messages. The AMF component allocates a fixed-size buffer for message processing but does not verify that incoming message fields conform to expected size constraints before performing copy operations. This allows an attacker to send oversized data that overflows the buffer boundaries.

Attack Vector

The attack vector is network-based, targeting the NGAP interface between gNB base stations and the AMF. An attacker with access to the 5G RAN (Radio Access Network) or positioned as a rogue gNB can craft a malicious UplinkRANConfigurationTransfer message with oversized fields. When the vulnerable AMF processes this message, the buffer overflow triggers a crash.

The vulnerability can be exploited by:

1. Establishing a connection to the AMF as a gNB (or compromising an existing gNB)
2. Sending a crafted UplinkRANConfigurationTransfer NGAP message with malformed size parameters
3. The AMF attempts to copy the oversized data into a fixed buffer, causing memory corruption
4. The AMF process crashes, denying service to all connected devices

Technical details and proof-of-concept information are available in the GitHub Gist resource and the free5gc GitHub issue discussion.

Detection Methods for CVE-2025-63679

Indicators of Compromise

• Unexpected AMF process crashes or restarts in free5gc deployments
• Abnormal or malformed UplinkRANConfigurationTransfer NGAP messages in network traffic logs
• Core dumps or error logs indicating buffer overflow or segmentation faults in the AMF component
• Repeated connection attempts from suspicious or unknown gNB identifiers

Detection Strategies

• Monitor AMF process stability and implement alerting for unexpected crashes or restarts
• Deploy NGAP protocol inspection to detect malformed or oversized message fields
• Implement anomaly detection for unusual patterns in gNB-to-AMF communication
• Review system logs for segmentation fault signals or memory access violations in AMF processes

Monitoring Recommendations

• Enable detailed logging for NGAP message processing within the free5gc AMF configuration
• Configure process monitoring with automatic restart capabilities while maintaining crash logs for forensic analysis
• Implement network-level monitoring on NGAP interfaces (typically SCTP over designated ports) to capture suspicious traffic patterns
• Set up alerting thresholds for AMF availability metrics and service degradation indicators

How to Mitigate CVE-2025-63679

Immediate Actions Required

• Assess your free5gc deployment to determine if you are running version 4.1.0 or earlier
• Review the free5gc GitHub issue #725 for the latest patch status and remediation guidance
• Implement network segmentation to restrict access to the AMF NGAP interface to trusted gNB sources only
• Consider deploying the AMF behind a validated NGAP proxy or firewall that can filter malformed messages

Patch Information

Check the free5gc GitHub repository for official patch releases addressing this vulnerability. Organizations should upgrade to a patched version of free5gc as soon as one becomes available. Monitor the project's release notes and security advisories for updates.

Workarounds

• Implement strict access control lists (ACLs) to limit NGAP connections to pre-authorized and validated gNB endpoints
• Deploy network-level filtering to inspect and drop malformed NGAP messages before they reach the AMF
• Consider running the AMF in a containerized environment with automatic restart policies to minimize service disruption
• Enable process supervision tools to automatically restart the AMF after crashes while logging incidents for investigation

# Example: Restrict NGAP interface access using iptables
# Replace gNB_IP_1, gNB_IP_2 with your authorized gNB addresses
# and AMF_NGAP_PORT with your configured NGAP port (default: 38412)

# Allow SCTP traffic from authorized gNBs only
iptables -A INPUT -p sctp --dport 38412 -s gNB_IP_1 -j ACCEPT
iptables -A INPUT -p sctp --dport 38412 -s gNB_IP_2 -j ACCEPT

# Drop all other NGAP traffic
iptables -A INPUT -p sctp --dport 38412 -j DROP