Vulnerability-Lookup

CVE-2026-55785 (GCVE-0-2026-55785)

Vulnerability from cvelistv5 – Published: 2026-08-28 22:25 – Updated: 2026-08-31 18:53

Title

free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

Summary

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ue_authentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES* and XRES* with strings.EqualFold and logs the expected XRES* value at INFO level before comparison. EapAuthComfirmRequestProcedure compares AT_MAC and XMAC with bytes.Equal and evaluates XRES == RES with ordinary string equality. These comparisons can return at mismatch-dependent times, although testing did not demonstrate a practical remote timing oracle because of HTTP/SBI timing noise. The INFO log exposes authentication material to operators, log collectors, sidecars, or processes able to read AUSF logs. This issue is fixed in version 1.4.5.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-31 15:21 UTC

CWE

CWE-208 - Observable Timing Discrepancy
CWE-385 - Covert Timing Channel
CWE-532 - Insertion of Sensitive Information into Log File

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/free5gc/free5gc/security/advis…	x_refsource_CONFIRM
https://github.com/free5gc/ausf/pull/63	x_refsource_MISC
https://github.com/free5gc/ausf/commit/7a5a4aa1ec…	x_refsource_MISC
https://github.com/free5gc/ausf/releases/tag/v1.4.5	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
free5gc	free5gc	Affected: < 1.4.5	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55785",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T15:21:05.453756Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T18:53:29.062Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "free5gc",
          "vendor": "free5gc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ue_authentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES* and XRES* with strings.EqualFold and logs the expected XRES* value at INFO level before comparison. EapAuthComfirmRequestProcedure compares AT_MAC and XMAC with bytes.Equal and evaluates XRES == RES with ordinary string equality. These comparisons can return at mismatch-dependent times, although testing did not demonstrate a practical remote timing oracle because of HTTP/SBI timing noise. The INFO log exposes authentication material to operators, log collectors, sidecars, or processes able to read AUSF logs. This issue is fixed in version 1.4.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-208",
              "description": "CWE-208: Observable Timing Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-385",
              "description": "CWE-385: Covert Timing Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T22:25:06.814Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-fp46-6vfw-gc9c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-fp46-6vfw-gc9c"
        },
        {
          "name": "https://github.com/free5gc/ausf/pull/63",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/free5gc/ausf/pull/63"
        },
        {
          "name": "https://github.com/free5gc/ausf/commit/7a5a4aa1ec6cd0e1febebf333911c3104968edf0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/free5gc/ausf/commit/7a5a4aa1ec6cd0e1febebf333911c3104968edf0"
        },
        {
          "name": "https://github.com/free5gc/ausf/releases/tag/v1.4.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/free5gc/ausf/releases/tag/v1.4.5"
        }
      ],
      "source": {
        "advisory": "GHSA-fp46-6vfw-gc9c",
        "discovery": "UNKNOWN"
      },
      "title": "free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55785",
    "datePublished": "2026-08-28T22:25:06.814Z",
    "dateReserved": "2026-06-17T14:40:28.380Z",
    "dateUpdated": "2026-08-31T18:53:29.062Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55785",
      "date": "2026-09-29",
      "epss": "0.00445",
      "percentile": "0.36239"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "free5gc",
                "vendor": "free5gc",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.4.5"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ue_authentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES* and XRES* with strings.EqualFold and logs the expected XRES* value at INFO level before comparison. EapAuthComfirmRequestProcedure compares AT_MAC and XMAC with bytes.Equal and evaluates XRES == RES with ordinary string equality. These comparisons can return at mismatch-dependent times, although testing did not demonstrate a practical remote timing oracle because of HTTP/SBI timing noise. The INFO log exposes authentication material to operators, log collectors, sidecars, or processes able to read AUSF logs. This issue is fixed in version 1.4.5."
          }
        ],
        "id": "CVE-2026-55785",
        "lastModified": "2026-09-08T21:11:31.703",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.7,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-55785",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T15:21:05.453756Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-28T23:17:07.697",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/free5gc/ausf/commit/7a5a4aa1ec6cd0e1febebf333911c3104968edf0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/free5gc/ausf/pull/63"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/free5gc/ausf/releases/tag/v1.4.5"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-fp46-6vfw-gc9c"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-208"
              },
              {
                "lang": "en",
                "value": "CWE-385"
              },
              {
                "lang": "en",
                "value": "CWE-532"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-09-09T00:16:24Z",
      "cve": "CVE-2026-55785",
      "id": "CVE-2026-55785",
      "initial_release_date": "2026-09-09T00:16:24Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-55785",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-55785.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55785",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-31T15:21:05.453756Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-31T15:21:06.489Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "free5gc",
              "vendor": "free5gc",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.4.5"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ue_authentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES* and XRES* with strings.EqualFold and logs the expected XRES* value at INFO level before comparison. EapAuthComfirmRequestProcedure compares AT_MAC and XMAC with bytes.Equal and evaluates XRES == RES with ordinary string equality. These comparisons can return at mismatch-dependent times, although testing did not demonstrate a practical remote timing oracle because of HTTP/SBI timing noise. The INFO log exposes authentication material to operators, log collectors, sidecars, or processes able to read AUSF logs. This issue is fixed in version 1.4.5."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.7,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-208",
                  "description": "CWE-208: Observable Timing Discrepancy",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-385",
                  "description": "CWE-385: Covert Timing Channel",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-532",
                  "description": "CWE-532: Insertion of Sensitive Information into Log File",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-28T22:25:06.814Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-fp46-6vfw-gc9c",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-fp46-6vfw-gc9c"
            },
            {
              "name": "https://github.com/free5gc/ausf/pull/63",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/free5gc/ausf/pull/63"
            },
            {
              "name": "https://github.com/free5gc/ausf/commit/7a5a4aa1ec6cd0e1febebf333911c3104968edf0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/free5gc/ausf/commit/7a5a4aa1ec6cd0e1febebf333911c3104968edf0"
            },
            {
              "name": "https://github.com/free5gc/ausf/releases/tag/v1.4.5",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/free5gc/ausf/releases/tag/v1.4.5"
            }
          ],
          "source": {
            "advisory": "GHSA-fp46-6vfw-gc9c",
            "discovery": "UNKNOWN"
          },
          "title": "free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-55785",
        "datePublished": "2026-08-28T22:25:06.814Z",
        "dateReserved": "2026-06-17T14:40:28.380Z",
        "dateUpdated": "2026-08-31T18:53:29.062Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55785

Vulnerability from fkie_nvd - Published: 2026-08-28 23:17 - Updated: 2026-09-08 21:11

Severity

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/free5gc/ausf/commit/7a5a4aa1ec6cd0e1febebf333911c3104968edf0
	security-advisories@github.com	https://github.com/free5gc/ausf/pull/63
	security-advisories@github.com	https://github.com/free5gc/ausf/releases/tag/v1.4.5
	security-advisories@github.com	https://github.com/free5gc/free5gc/security/advisories/GHSA-fp46-6vfw-gc9c

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "free5gc",
          "vendor": "free5gc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ue_authentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES* and XRES* with strings.EqualFold and logs the expected XRES* value at INFO level before comparison. EapAuthComfirmRequestProcedure compares AT_MAC and XMAC with bytes.Equal and evaluates XRES == RES with ordinary string equality. These comparisons can return at mismatch-dependent times, although testing did not demonstrate a practical remote timing oracle because of HTTP/SBI timing noise. The INFO log exposes authentication material to operators, log collectors, sidecars, or processes able to read AUSF logs. This issue is fixed in version 1.4.5."
    }
  ],
  "id": "CVE-2026-55785",
  "lastModified": "2026-09-08T21:11:31.703",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55785",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-31T15:21:05.453756Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-28T23:17:07.697",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/free5gc/ausf/commit/7a5a4aa1ec6cd0e1febebf333911c3104968edf0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/free5gc/ausf/pull/63"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/free5gc/ausf/releases/tag/v1.4.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-fp46-6vfw-gc9c"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-208"
        },
        {
          "lang": "en",
          "value": "CWE-385"
        },
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-FP46-6VFW-GC9C

Vulnerability from github – Published: 2026-08-28 22:26 – Updated: 2026-08-28 22:26

Summary

free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

Details

Summary

The AUSF component of free5GC compares authentication response values with normal Go equality helpers instead of constant-time cryptographic comparison functions.

Two authentication flows are affected in internal/sbi/processor/ue_authentication.go:

5G-AKA confirmation compares RES* and XRES* with strings.EqualFold().
EAP-AKA' confirmation compares AT_MAC with bytes.Equal() and compares XRES and RES with ==.

These functions are not designed to be constant-time cryptographic comparators and may return earlier depending on the location of the first mismatch.

Additionally, the 5G-AKA confirmation path logs both the received res* and the expected Xres* at INFO level immediately before comparing them. The XRES* value is authentication material and should not be written to application logs.

The timing side channel was confirmed as a code issue, but practical exploitation over HTTP was not demonstrated in the lab because the comparator-level signal is much smaller than HTTP/SBI noise. The XRES* logging issue is directly observable in AUSF logs.

Confirmed on github.com/free5gc/ausf v1.4.4 and current main as of the May 2026 analysis.

Details

5G-AKA: `RES` / `XRES`

In Auth5gAkaComfirmRequestProcedure(), the AUSF logs both values and then compares them with strings.EqualFold():

// internal/sbi/processor/ue_authentication.go
logger.Auth5gAkaLog.Infof("res*: %x\nXres*: %x\n",
    updateConfirmationData.ResStar, ausfCurrentContext.XresStar)

if strings.EqualFold(updateConfirmationData.ResStar, ausfCurrentContext.XresStar) {
    ausfCurrentContext.AuthStatus = models.AusfUeAuthenticationAuthResult_SUCCESS
    confirmDataRsp.AuthResult = models.AusfUeAuthenticationAuthResult_SUCCESS
    success = true
    logger.Auth5gAkaLog.Infoln("5G AKA confirmation succeeded")
    // ...
}

For hexadecimal ASCII strings, strings.EqualFold() performs a character comparison that can terminate when a mismatch is found. It is not a constant-time comparison primitive.

The line immediately before the comparison is more directly exploitable: it writes XresStar to INFO logs. Any operator, compromised sidecar, log collector, SIEM user, or local process with access to AUSF logs can read the expected response value for authentication attempts.

EAP-AKA': `AT_MAC`, `XMAC`, `XRES`, and `RES`

In EapAuthComfirmRequestProcedure(), the AUSF computes the expected MAC and compares it with the received AT_MAC using bytes.Equal():

K_autStr := ausfCurrentContext.K_aut
K_aut, _ := hex.DecodeString(K_autStr)
XMAC := CalculateAtMAC(K_aut, decodeEapAkaPrimePkt.MACInput)
MAC := decodeEapAkaPrimePkt.Attributes[ausf_context.AT_MAC_ATTRIBUTE].Value
XRES := ausfCurrentContext.XRES
RES := hex.EncodeToString(decodeEapAkaPrimePkt.Attributes[ausf_context.AT_RES_ATTRIBUTE].Value)

if !bytes.Equal(MAC, XMAC) {
    eapOK = false
    eapErrStr = "EAP-AKA' integrity check fail"
} else if XRES == RES {
    logger.AuthELog.Infoln("Correct RES value, EAP-AKA' auth succeed")
    // ...
}

bytes.Equal() is not specified as a constant-time cryptographic comparison. The subsequent XRES == RES string comparison is also not constant-time. The correct primitive for comparing authentication tags and secret response values in Go is crypto/subtle.ConstantTimeCompare, after validating and normalizing input length and encoding.

The EAP-AKA' case is harder to exploit remotely than the 5G-AKA case because the XRES == RES comparison is reached only if AT_MAC is valid. Producing a valid AT_MAC requires session-specific K_aut.

Evidence

Static evidence

Static analysis confirmed:

strings.EqualFold(updateConfirmationData.ResStar, ausfCurrentContext.XresStar) in the 5G-AKA confirmation path.
logger.Auth5gAkaLog.Infof("res*: %x\nXres*: %x\n", ...) immediately before the comparison.
bytes.Equal(MAC, XMAC) in the EAP-AKA' confirmation path.
XRES == RES in the EAP-AKA' confirmation path.
crypto/subtle is absent from the AUSF authentication processor code.

Internal evidence:

hallazgos/finding10-hres-timing/evidencia/20260526-090151-static-analysis/
hallazgos/finding11-eap-mac-timing/evidencia/20260526-094642-static-analysis/

5G-AKA timing and logging evidence

A timing PoC sent 500 iterations per condition over loopback HTTP/SBI:

Condition A: mismatch near the start
Condition B: mismatch in the middle
Condition C: mismatch near the end
Condition D: full match

The comparator-position signal was not distinguishable from HTTP noise:

Delta C-A: approximately -1.5 us
2-sigma noise threshold: approximately 557 us
Result: SIGNAL NOT CLEAR

This is consistent with the expected signal-to-noise ratio: the comparator-level timing difference is in the nanosecond range, while the HTTP/SBI path adds hundreds of microseconds of variance.

The same lab run confirmed that AUSF logs include XresStar in plaintext at INFO level. This does not require statistical inference.

Internal evidence:

hallazgos/finding10-hres-timing/evidencia/20260526-093558-timing-poc/

EAP-AKA' timing evidence

A timing PoC sent 500 iterations per condition against the EAP-AKA' confirmation path:

A: first MAC byte incorrect
B: first 8 MAC bytes correct
C: MAC correct, XRES incorrect
D: MAC correct, XRES correct

Observed medians were all around 464-467 us, and the HTTP-level timing signal was not detectable:

A: 466.6 us
B: 466.5 us
C: 464.2 us
D: 464.2 us
Delta D-A: approximately -2.4 us
2-sigma noise threshold: approximately 716 us
Result: SIGNAL NOT CLEAR

This confirms the expected practical limitation of a remote HTTP timing attack.

Internal evidence:

hallazgos/finding11-eap-mac-timing/evidencia/20260526-103822-timing-poc/

Local CPU benchmark for `bytes.Equal()`

A direct Go microbenchmark without HTTP overhead measured bytes.Equal() for 16-byte values. The raw benchmark data showed a monotonic increase as more leading bytes matched. The median delta from N=0 matching bytes to N=15 matching bytes was roughly 0.31 ns, or more than 20%.

This confirms that the local comparator is not position-independent at CPU level, even though the signal is too small to exploit remotely over HTTP in normal conditions.

Internal evidence:

hallazgos/finding11-eap-mac-timing/evidencia/20260526-104842-cpu-benchmark/

Uprobe path confirmation

Linux uprobes on the live AUSF process confirmed that requests reach the relevant comparison paths:

MAC comparison path is hit for both failing and successful EAP-AKA' attempts.
XRES comparison path is hit only when MAC verification passes.

Internal evidence:

hallazgos/finding11-eap-mac-timing/evidencia/20260526-053510-ebpf-uprobe/

Impact

There are two impact classes.

Sensitive value in logs

The 5G-AKA path logs XRES*, the expected response value, at INFO level. In deployments where AUSF logs are collected centrally or are readable by lower-privileged operators, infrastructure agents, compromised containers, or log-processing systems, this exposes authentication material that should remain internal to the authentication procedure.

The exact exploitability depends on whether the attacker can correlate log access with an active authentication context and submit the confirmation before the context is consumed or failed. Regardless, writing XRES* to application logs is an unsafe handling of authentication material.

Timing side channel / cryptographic hardening issue

The non-constant-time comparisons are real code issues and should be fixed, but we did not demonstrate a practical remote timing oracle over HTTP/SBI. The measured comparator signal is too small relative to HTTP noise in the lab.

The risk is higher in environments where an attacker has a lower-noise measurement point, local co-residency, kernel tracing capabilities, or another side channel that can observe the comparison more directly.

Suggested remediation

Remove XRES*, RES*, XRES, RES, K_aut, AT_MAC, and derived authentication material from INFO logs. If logging is necessary, log only metadata such as the authentication context ID, SUPI/SUCI in redacted form, result, and failure class.
Replace strings.EqualFold() and string == comparisons for authentication values with constant-time comparisons.
Normalize encodings before comparison. For hex-encoded values, decode both inputs first, validate expected lengths, and then compare fixed-size byte slices.

Example for 5G-AKA:

resStar, err1 := hex.DecodeString(updateConfirmationData.ResStar)
xresStar, err2 := hex.DecodeString(ausfCurrentContext.XresStar)

if err1 == nil && err2 == nil &&
    len(resStar) == len(xresStar) &&
    subtle.ConstantTimeCompare(resStar, xresStar) == 1 {
    // success
} else {
    // failure
}

Example for EAP-AKA' MAC:

if len(MAC) != len(XMAC) || subtle.ConstantTimeCompare(MAC, XMAC) != 1 {
    eapOK = false
    eapErrStr = "EAP-AKA' integrity check fail"
}

Example for EAP-AKA' XRES:

res, err1 := hex.DecodeString(RES)
xres, err2 := hex.DecodeString(XRES)

if err1 == nil && err2 == nil &&
    len(res) == len(xres) &&
    subtle.ConstantTimeCompare(res, xres) == 1 {
    // success
}

Add unit tests that ensure authentication values are not written to logs.
Consider avoiding a second UDM notification call in the 5G-AKA failure path if the first failure notification already reports the result. In the lab, failure performed two UDM calls while success performed one; this creates a coarse success/failure timing difference, although that result is already visible through the API response.

Prior art / non-duplication note

Known recent free5GC AUSF issues such as CVE-2026-33063 concern different failure modes and code paths. This report concerns cryptographic comparison and logging behavior in internal/sbi/processor/ue_authentication.go.

Severity

3.7 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/free5gc/ausf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55785"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208",
      "CWE-385",
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T22:26:16Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Summary\n\nThe AUSF component of free5GC compares authentication response values with normal Go equality helpers instead of constant-time cryptographic comparison functions.\n\nTwo authentication flows are affected in `internal/sbi/processor/ue_authentication.go`:\n\n1. 5G-AKA confirmation compares `RES*` and `XRES*` with `strings.EqualFold()`.\n2. EAP-AKA\u0027 confirmation compares `AT_MAC` with `bytes.Equal()` and compares `XRES` and `RES` with `==`.\n\nThese functions are not designed to be constant-time cryptographic comparators and may return earlier depending on the location of the first mismatch.\n\nAdditionally, the 5G-AKA confirmation path logs both the received `res*` and the expected `Xres*` at INFO level immediately before comparing them. The `XRES*` value is authentication material and should not be written to application logs.\n\nThe timing side channel was confirmed as a code issue, but practical exploitation over HTTP was not demonstrated in the lab because the comparator-level signal is much smaller than HTTP/SBI noise. The `XRES*` logging issue is directly observable in AUSF logs.\n\nConfirmed on `github.com/free5gc/ausf` v1.4.4 and current main as of the May 2026 analysis.\n\n### Details\n\n#### 5G-AKA: `RES*` / `XRES*`\n\nIn `Auth5gAkaComfirmRequestProcedure()`, the AUSF logs both values and then compares them with `strings.EqualFold()`:\n\n```go\n// internal/sbi/processor/ue_authentication.go\nlogger.Auth5gAkaLog.Infof(\"res*: %x\\nXres*: %x\\n\",\n    updateConfirmationData.ResStar, ausfCurrentContext.XresStar)\n\nif strings.EqualFold(updateConfirmationData.ResStar, ausfCurrentContext.XresStar) {\n    ausfCurrentContext.AuthStatus = models.AusfUeAuthenticationAuthResult_SUCCESS\n    confirmDataRsp.AuthResult = models.AusfUeAuthenticationAuthResult_SUCCESS\n    success = true\n    logger.Auth5gAkaLog.Infoln(\"5G AKA confirmation succeeded\")\n    // ...\n}\n```\n\nFor hexadecimal ASCII strings, `strings.EqualFold()` performs a character comparison that can terminate when a mismatch is found. It is not a constant-time comparison primitive.\n\nThe line immediately before the comparison is more directly exploitable: it writes `XresStar` to INFO logs. Any operator, compromised sidecar, log collector, SIEM user, or local process with access to AUSF logs can read the expected response value for authentication attempts.\n\n#### EAP-AKA\u0027: `AT_MAC`, `XMAC`, `XRES`, and `RES`\n\nIn `EapAuthComfirmRequestProcedure()`, the AUSF computes the expected MAC and compares it with the received `AT_MAC` using `bytes.Equal()`:\n\n```go\nK_autStr := ausfCurrentContext.K_aut\nK_aut, _ := hex.DecodeString(K_autStr)\nXMAC := CalculateAtMAC(K_aut, decodeEapAkaPrimePkt.MACInput)\nMAC := decodeEapAkaPrimePkt.Attributes[ausf_context.AT_MAC_ATTRIBUTE].Value\nXRES := ausfCurrentContext.XRES\nRES := hex.EncodeToString(decodeEapAkaPrimePkt.Attributes[ausf_context.AT_RES_ATTRIBUTE].Value)\n\nif !bytes.Equal(MAC, XMAC) {\n    eapOK = false\n    eapErrStr = \"EAP-AKA\u0027 integrity check fail\"\n} else if XRES == RES {\n    logger.AuthELog.Infoln(\"Correct RES value, EAP-AKA\u0027 auth succeed\")\n    // ...\n}\n```\n\n`bytes.Equal()` is not specified as a constant-time cryptographic comparison. The subsequent `XRES == RES` string comparison is also not constant-time. The correct primitive for comparing authentication tags and secret response values in Go is `crypto/subtle.ConstantTimeCompare`, after validating and normalizing input length and encoding.\n\nThe EAP-AKA\u0027 case is harder to exploit remotely than the 5G-AKA case because the `XRES == RES` comparison is reached only if `AT_MAC` is valid. Producing a valid `AT_MAC` requires session-specific `K_aut`.\n\n### Evidence\n\n#### Static evidence\n\nStatic analysis confirmed:\n\n- `strings.EqualFold(updateConfirmationData.ResStar, ausfCurrentContext.XresStar)` in the 5G-AKA confirmation path.\n- `logger.Auth5gAkaLog.Infof(\"res*: %x\\nXres*: %x\\n\", ...)` immediately before the comparison.\n- `bytes.Equal(MAC, XMAC)` in the EAP-AKA\u0027 confirmation path.\n- `XRES == RES` in the EAP-AKA\u0027 confirmation path.\n- `crypto/subtle` is absent from the AUSF authentication processor code.\n\nInternal evidence:\n\n```text\nhallazgos/finding10-hres-timing/evidencia/20260526-090151-static-analysis/\nhallazgos/finding11-eap-mac-timing/evidencia/20260526-094642-static-analysis/\n```\n\n#### 5G-AKA timing and logging evidence\n\nA timing PoC sent 500 iterations per condition over loopback HTTP/SBI:\n\n```text\nCondition A: mismatch near the start\nCondition B: mismatch in the middle\nCondition C: mismatch near the end\nCondition D: full match\n```\n\nThe comparator-position signal was not distinguishable from HTTP noise:\n\n```text\nDelta C-A: approximately -1.5 us\n2-sigma noise threshold: approximately 557 us\nResult: SIGNAL NOT CLEAR\n```\n\nThis is consistent with the expected signal-to-noise ratio: the comparator-level timing difference is in the nanosecond range, while the HTTP/SBI path adds hundreds of microseconds of variance.\n\nThe same lab run confirmed that AUSF logs include `XresStar` in plaintext at INFO level. This does not require statistical inference.\n\nInternal evidence:\n\n```text\nhallazgos/finding10-hres-timing/evidencia/20260526-093558-timing-poc/\n```\n\n#### EAP-AKA\u0027 timing evidence\n\nA timing PoC sent 500 iterations per condition against the EAP-AKA\u0027 confirmation path:\n\n```text\nA: first MAC byte incorrect\nB: first 8 MAC bytes correct\nC: MAC correct, XRES incorrect\nD: MAC correct, XRES correct\n```\n\nObserved medians were all around 464-467 us, and the HTTP-level timing signal was not detectable:\n\n```text\nA: 466.6 us\nB: 466.5 us\nC: 464.2 us\nD: 464.2 us\nDelta D-A: approximately -2.4 us\n2-sigma noise threshold: approximately 716 us\nResult: SIGNAL NOT CLEAR\n```\n\nThis confirms the expected practical limitation of a remote HTTP timing attack.\n\nInternal evidence:\n\n```text\nhallazgos/finding11-eap-mac-timing/evidencia/20260526-103822-timing-poc/\n```\n\n#### Local CPU benchmark for `bytes.Equal()`\n\nA direct Go microbenchmark without HTTP overhead measured `bytes.Equal()` for 16-byte values. The raw benchmark data showed a monotonic increase as more leading bytes matched. The median delta from `N=0` matching bytes to `N=15` matching bytes was roughly 0.31 ns, or more than 20%.\n\nThis confirms that the local comparator is not position-independent at CPU level, even though the signal is too small to exploit remotely over HTTP in normal conditions.\n\nInternal evidence:\n\n```text\nhallazgos/finding11-eap-mac-timing/evidencia/20260526-104842-cpu-benchmark/\n```\n\n#### Uprobe path confirmation\n\nLinux uprobes on the live AUSF process confirmed that requests reach the relevant comparison paths:\n\n- MAC comparison path is hit for both failing and successful EAP-AKA\u0027 attempts.\n- XRES comparison path is hit only when MAC verification passes.\n\nInternal evidence:\n\n```text\nhallazgos/finding11-eap-mac-timing/evidencia/20260526-053510-ebpf-uprobe/\n```\n\n### Impact\n\nThere are two impact classes.\n\n#### Sensitive value in logs\n\nThe 5G-AKA path logs `XRES*`, the expected response value, at INFO level. In deployments where AUSF logs are collected centrally or are readable by lower-privileged operators, infrastructure agents, compromised containers, or log-processing systems, this exposes authentication material that should remain internal to the authentication procedure.\n\nThe exact exploitability depends on whether the attacker can correlate log access with an active authentication context and submit the confirmation before the context is consumed or failed. Regardless, writing `XRES*` to application logs is an unsafe handling of authentication material.\n\n#### Timing side channel / cryptographic hardening issue\n\nThe non-constant-time comparisons are real code issues and should be fixed, but we did not demonstrate a practical remote timing oracle over HTTP/SBI. The measured comparator signal is too small relative to HTTP noise in the lab.\n\nThe risk is higher in environments where an attacker has a lower-noise measurement point, local co-residency, kernel tracing capabilities, or another side channel that can observe the comparison more directly.\n\n### Suggested remediation\n\n1. Remove `XRES*`, `RES*`, `XRES`, `RES`, `K_aut`, `AT_MAC`, and derived authentication material from INFO logs. If logging is necessary, log only metadata such as the authentication context ID, SUPI/SUCI in redacted form, result, and failure class.\n\n2. Replace `strings.EqualFold()` and string `==` comparisons for authentication values with constant-time comparisons.\n\n3. Normalize encodings before comparison. For hex-encoded values, decode both inputs first, validate expected lengths, and then compare fixed-size byte slices.\n\nExample for 5G-AKA:\n\n```go\nresStar, err1 := hex.DecodeString(updateConfirmationData.ResStar)\nxresStar, err2 := hex.DecodeString(ausfCurrentContext.XresStar)\n\nif err1 == nil \u0026\u0026 err2 == nil \u0026\u0026\n    len(resStar) == len(xresStar) \u0026\u0026\n    subtle.ConstantTimeCompare(resStar, xresStar) == 1 {\n    // success\n} else {\n    // failure\n}\n```\n\nExample for EAP-AKA\u0027 MAC:\n\n```go\nif len(MAC) != len(XMAC) || subtle.ConstantTimeCompare(MAC, XMAC) != 1 {\n    eapOK = false\n    eapErrStr = \"EAP-AKA\u0027 integrity check fail\"\n}\n```\n\nExample for EAP-AKA\u0027 XRES:\n\n```go\nres, err1 := hex.DecodeString(RES)\nxres, err2 := hex.DecodeString(XRES)\n\nif err1 == nil \u0026\u0026 err2 == nil \u0026\u0026\n    len(res) == len(xres) \u0026\u0026\n    subtle.ConstantTimeCompare(res, xres) == 1 {\n    // success\n}\n```\n\n4. Add unit tests that ensure authentication values are not written to logs.\n\n5. Consider avoiding a second UDM notification call in the 5G-AKA failure path if the first failure notification already reports the result. In the lab, failure performed two UDM calls while success performed one; this creates a coarse success/failure timing difference, although that result is already visible through the API response.\n\n### Prior art / non-duplication note\n\nKnown recent free5GC AUSF issues such as CVE-2026-33063 concern different failure modes and code paths. This report concerns cryptographic comparison and logging behavior in `internal/sbi/processor/ue_authentication.go`.",
  "id": "GHSA-fp46-6vfw-gc9c",
  "modified": "2026-08-28T22:26:16Z",
  "published": "2026-08-28T22:26:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-fp46-6vfw-gc9c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/ausf/commit/7a5a4aa1ec6cd0e1febebf333911c3104968edf0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/free5gc/free5gc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-55785 (GCVE-0-2026-55785)

FKIE_CVE-2026-55785

GHSA-FP46-6VFW-GC9C

Summary

Details

5G-AKA: RES* / XRES*

EAP-AKA': AT_MAC, XMAC, XRES, and RES

Evidence

Static evidence

5G-AKA timing and logging evidence

EAP-AKA' timing evidence

Local CPU benchmark for bytes.Equal()

Uprobe path confirmation

Impact

Sensitive value in logs

Timing side channel / cryptographic hardening issue

Suggested remediation

Prior art / non-duplication note

Tags

Sightings

Nomenclature

Related by attack behaviour

5G-AKA: `RES` / `XRES`

EAP-AKA': `AT_MAC`, `XMAC`, `XRES`, and `RES`

Local CPU benchmark for `bytes.Equal()`