GitHub Security Advisory: GHSA-wwqh-7jm5-gj7w
Package: github.com/free5gc/pcf (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-476: NULL Pointer Dereference, CWE-754: Improper Check for Unusual or Exceptional Conditions
Vulnerable versions: < 1.4.3
Patched in: 1.4.3

Summary: free5GC's PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing AfRoutReq via nil pointer dereference

Details:
### Summary
free5GC's PCF `POST /npcf-policyauthorization/v1/app-sessions` handler panics on a single authenticated request whose `ascReqData.suppFeat == "1"` (enabling traffic-routing feature negotiation) and whose `medComponents` entries supply an `afAppId` but NO `AfRoutReq`. The create path then calls `provisioningOfTrafficRoutingInfo(smPolicy, appID, routeReq, ...)` with `routeReq == nil` and dereferences `routeReq.RouteToLocs` (and other fields) without a nil check, causing `runtime error: invalid memory address or nil pointer dereference`. Gin recovery converts the panic into `HTTP 500`.

The trigger is a single valid authenticated request -- changing only `suppFeat` from `"0"` to `"1"` flips the same shape of POST from a normal `201 Created` into a panic-driven `500`.

This endpoint requires a valid `npcf-policyauthorization` OAuth2 access token (PR:L). The PCF process is not killed (Gin recovers); the realized impact is per-request panic-DoS on the app-session create path.

### Details
Validated against the PCF container in the official Docker compose lab.
- Source repo tag: `v4.2.1`
- PCF endpoint: `http://10.100.200.9:8000`
- Validation date: 2026-03-12

Vulnerable handler path:
```
postAppSessCtxProcedure
 -> medComponents loop
   -> appID := medComp.AfAppId
      routeReq := medComp.AfRoutReq   // nil when AfRoutReq absent
      provisioningOfTrafficRoutingInfo(smPolicy, appID, routeReq, medComp.FStatus)
```

In `provisioningOfTrafficRoutingInfo`, `routeReq.RouteToLocs`, `routeReq.UpPathChgSub`, and `routeReq.AppReloc` are dereferenced directly without a nil check. When `suppFeat` is `"0"` the traffic-routing branch is not entered and the same input shape returns `201 Created`; when `suppFeat` is `"1"` the branch is entered and the nil-deref fires.

Code evidence (paths in `free5gc/pcf`):
- Affected route + dispatch: `NFs/pcf/internal/sbi/api_policyauthorization.go`
- Create handler path: `NFs/pcf/internal/sbi/processor/policyauthorization.go`
- Call site that passes nil `routeReq` into the traffic-routing helper: `NFs/pcf/internal/sbi/processor/policyauthorization.go`
- Panic site (nil deref of `routeReq.*` fields): `NFs/pcf/internal/sbi/processor/policyauthorization.go:1740`

### PoC
Reproduced end-to-end against the running PCF at `http://10.100.200.9:8000`.

1. Obtain a valid `npcf-policyauthorization` token from NRF:
```
curl -sS -X POST 'http://10.100.200.3:8000/oauth2/token' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data 'grant_type=client_credentials&nfType=NEF&nfInstanceId=b84c4f0a-6010-4972-8480-e44e625b9ee4&targetNfType=PCF&scope=npcf-policyauthorization'
```

2. Trigger the panic with a single valid authenticated POST whose `ascReqData.suppFeat == "1"`, `medComponents` supplies `afAppId`, and `AfRoutReq` is absent:
```
curl -i -X POST 'http://10.100.200.9:8000/npcf-policyauthorization/v1/app-sessions' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer <valid_npcf_policyauthorization