Suse
CVE-2026-33063
HIGH
GHSA-4jrw-92fg-4jwx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionGitHub Advisory
Impact This is an Improper Null Check vulnerability leading to Denial of Service.
- Security Impact: A remote attacker can cause the AUSF service to panic and crash by sending a crafted UE authentication request that triggers a nil interface conversion in the
GetSupiFromSuciSupiMapfunction. This results in complete denial of service for the AUSF authentication service. - Functional Impact: The
GetSupiFromSuciSupiMapfunction attempts to perform an interface conversion frominterface{}to*context.SuciSupiMapwithout checking if the underlying value is nil. WhenSuciSupiMapis nil, the code panics with "interface conversion: interface {} is nil, not *context.SuciSupiMap". - Affected Parties: All deployments of free5GC v4.0.1 using the AUSF UE authentication service (
/nausf-auth/v1/ue-authenticationsendpoint).
Patches Yes, the issue has been patched. The fix is implemented in PR free5gc/ausf#52 (commit: [add specific commit hash if available]). Users should upgrade to the next release of free5GC that includes this commit.
Workarounds There is no direct workaround at the application level. The recommendation is to apply the provided patch or restrict access to the AUSF API to trusted sources only.
AnalysisAI
The free5GC AUSF authentication service is vulnerable to denial of service through an improper null check in the GetSupiFromSuciSupiMap function, which crashes when processing crafted UE authentication requests that trigger unsafe interface conversion. Remote attackers can exploit this vulnerability to completely disable the AUSF service by sending a specially crafted authentication request containing a nil SuciSupiMap value. A patch is available for affected free5GC v4.0.1 deployments.
Technical ContextAI
This vulnerability affects the free5GC open-source 5G Core Network implementation, specifically the AUSF (Authentication Server Function) component which handles UE (User Equipment) authentication in 5G networks per 3GPP specifications. The affected package is pkg:go/github.com_free5gc_ausf. The root cause is CWE-476 (NULL Pointer Dereference) where the GetSupiFromSuciSupiMap function attempts to convert an interface{} type to *context.SuciSupiMap without validating whether the underlying value is nil. When the SuciSupiMap is nil, Go's runtime panics with an interface conversion error, crashing the entire AUSF service. The vulnerability is exposed through the /nausf-auth/v1/ue-authentications REST API endpoint used for 5G authentication procedures.
RemediationAI
Upgrade the free5GC AUSF component to incorporate the patch provided in GitHub pull request free5gc/ausf#52, specifically commit 3b9ac4403c2756dc89a5ed3cdcefe688458588aa available at https://github.com/free5gc/ausf/commit/3b9ac4403c2756dc89a5ed3cdcefe688458588aa. Users should apply the next official release of free5GC that includes this commit. As an interim measure until patching is possible, implement network-level access controls to restrict the AUSF API endpoints to trusted sources only, such as using firewall rules or API gateway authentication to limit access to the /nausf-auth/v1/ue-authentications endpoint to authorized network functions within the 5G core. Consult the security advisory at https://github.com/advisories/GHSA-4jrw-92fg-4jwx for additional vendor guidance.
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today