free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA (CVE-2026-55785)

free5GC AUSF compares authentication response values using non-constant-time functions such as strings.EqualFold() and bytes.Equal() instead of constant-time cryptographic comparison functions, leading to potential timing side-channel leakage. In the 5G-AKA flow, the AUSF logs both the received RES* and expected XRES* values at INFO level before comparison, exposing sensitive authentication material. The EAP-AKA' flow similarly uses non-constant-time comparisons for AT_MAC and RES values. Static analysis confirmed these issues in the codebase (github.com/free5gc/ausf v1.4.4 and main branch as of May 2026). Timing differences at the comparator level are too small to be reliably exploited remotely over HTTP/SBI due to noise. The logging of XRES* is directly observable and poses an information exposure risk.

The vulnerability allows potential timing side-channel attacks due to non-constant-time comparisons of authentication values, which could theoretically leak secret authentication material. However, practical remote exploitation is unlikely due to high noise in the HTTP/SBI communication path. The logging of XRES* values at INFO level exposes sensitive authentication material to anyone with access to AUSF logs, increasing the risk of credential exposure. The overall impact is limited confidentiality exposure without direct integrity or availability impact.

A patch is available for free5GC AUSF to replace non-constant-time comparison functions with constant-time cryptographic comparisons and to remove logging of sensitive authentication material. Users should upgrade to version 1.4.5 or later. Until patched, restrict access to AUSF logs to trusted personnel only to mitigate exposure of XRES* values. No other immediate action is required as the timing side-channel is difficult to exploit remotely.