CVE-2025-70122 Overview
A heap buffer overflow vulnerability exists in the User Plane Function (UPF) component of free5GC v4.0.1, an open-source implementation of 5G core network functions. Remote attackers can exploit this vulnerability to cause a denial of service by sending a crafted PFCP (Packet Forwarding Control Protocol) Session Modification Request. The vulnerability resides in the SDFFilterFields.UnmarshalBinary function within sdf-filter.go, where improper handling of declared lengths that exceed actual buffer capacity leads to a runtime panic and subsequent UPF crash.
Critical Impact
This vulnerability allows unauthenticated remote attackers to crash the UPF component, disrupting 5G network user plane operations and potentially affecting all connected mobile users.
Affected Products
- free5GC v4.0.1
- free5GC UPF component with vulnerable SDFFilterFields.UnmarshalBinary implementation
- 5G core network deployments utilizing affected free5GC versions
Discovery Timeline
- 2026-02-13 - CVE-2025-70122 published to NVD
- 2026-02-18 - Last updated in NVD database
Technical Details for CVE-2025-70122
Vulnerability Analysis
This heap buffer overflow vulnerability (CWE-122) affects the UPF component's PFCP message parsing functionality. The UPF is a critical 5G network element responsible for packet routing and forwarding between the Radio Access Network (RAN) and external data networks.
The vulnerability stems from insufficient validation when deserializing SDF (Service Data Flow) filter fields. When the SDFFilterFields.UnmarshalBinary function processes incoming PFCP Session Modification Requests, it trusts the declared length value embedded in the message without verifying it against the actual buffer capacity. An attacker can craft a malicious request with a length value exceeding the available data, causing the Go runtime to panic due to an out-of-bounds memory access attempt.
The attack requires no authentication and can be executed remotely over the network, making it particularly dangerous in exposed 5G deployments. While the vulnerability does not enable code execution or data theft, the denial of service impact is significant for telecom infrastructure.
Root Cause
The root cause lies in the SDFFilterFields.UnmarshalBinary function in sdf-filter.go. The function fails to properly validate that the declared length field in incoming PFCP messages does not exceed the actual size of the buffer being processed. This missing bounds check allows an attacker to specify an arbitrary length value that triggers an out-of-bounds read operation, causing the Go runtime to panic and terminate the UPF process.
Attack Vector
The attack is network-based and requires no user interaction or special privileges. An attacker can remotely target the PFCP interface of the UPF component by:
- Crafting a malicious PFCP Session Modification Request with an SDF Filter field
- Setting the length field to a value larger than the actual data provided in the buffer
- Sending the crafted request to the target UPF's PFCP interface
- The UnmarshalBinary function attempts to read beyond the buffer boundary
- Go runtime detects the out-of-bounds access and triggers a panic, crashing the UPF service
The vulnerability manifests during binary unmarshaling of SDF filter fields in PFCP messages. When processing the declared length parameter, insufficient validation allows attackers to trigger runtime panics. For detailed technical analysis, refer to the free5GC GitHub issue report.
Detection Methods for CVE-2025-70122
Indicators of Compromise
- Unexpected UPF service crashes or restarts in free5GC deployments
- PFCP Session Modification Requests with abnormally large SDF Filter length values
- Runtime panic messages in UPF logs referencing SDFFilterFields.UnmarshalBinary or sdf-filter.go
- Unusual traffic patterns targeting PFCP ports (typically UDP 8805)
Detection Strategies
- Monitor UPF process stability and alert on unexpected terminations or rapid restart cycles
- Implement deep packet inspection on PFCP traffic to detect malformed Session Modification Requests with suspicious length fields
- Configure log aggregation to capture and alert on Go runtime panic messages from UPF components
- Deploy network anomaly detection to identify unusual PFCP traffic patterns or sources
Monitoring Recommendations
- Enable comprehensive logging for the free5GC UPF component, particularly for PFCP message processing
- Set up automated alerts for UPF service availability degradation or repeated crashes
- Monitor PFCP interface traffic volumes and connection sources for anomalous activity
- Implement health checks that detect UPF unresponsiveness before user impact occurs
How to Mitigate CVE-2025-70122
Immediate Actions Required
- Identify all free5GC v4.0.1 deployments in your environment and assess exposure
- Restrict network access to PFCP interfaces using firewall rules, limiting connections to trusted network elements only
- Implement rate limiting on PFCP endpoints to reduce the impact of exploitation attempts
- Monitor UPF service health and configure automatic restart mechanisms to minimize downtime during attacks
Patch Information
The vulnerability has been reported to the free5GC project maintainers. Organizations should monitor the free5GC GitHub repository for security updates and apply patches as soon as they become available. Contact free5GC maintainers for guidance on obtaining a patched version that includes proper bounds checking in the SDFFilterFields.UnmarshalBinary function.
Workarounds
- Deploy PFCP traffic filtering at the network perimeter to block malformed requests before they reach the UPF
- Implement network segmentation to ensure PFCP interfaces are not exposed to untrusted networks
- Configure process monitoring and automatic restart for the UPF service to minimize denial of service duration
- Consider deploying a PFCP proxy or gateway that can validate message integrity before forwarding to the UPF
# Example: Restrict PFCP interface access using iptables
# Only allow PFCP traffic from trusted SMF addresses
iptables -A INPUT -p udp --dport 8805 -s <trusted_smf_ip> -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
