Executive brief
free5gc is an open-source 5G core network implementation. An attacker can crash the AMF (Access and Mobility Management Function) component by sending specially crafted NGAP protocol messages in an incorrect sequence, causing service disruption for legitimate mobile subscribers. This NULL pointer dereference requires network access to the AMF but no authentication, making it a straightforward denial-of-service attack vector.
Technical details
A NULL pointer dereference exists in the AMF NGAP Dispatcher when it fails to validate the mandatory message sequence during RAN connection initialization. The dispatcher creates an AmfRan context for any incoming NGAP message on a new SCTP connection, bypassing the requirement that the first message must be NGSetupRequest. If a subsequent message (e.g., UEContextReleaseComplete) arrives before the registration flow completes, the handler attempts to dereference an uninitialized UE context pointer, triggering a panic. An attacker with network access to the AMF can exploit this via crafted NGAP messages on a new SCTP connection; no prior authentication or user interaction is required. This causes repeated AMF process crashes and service denial to legitimate users. Patches addressing the message sequence validation are available in later versions of free5gc.
Affected products
- free5gc free5gc v4.0.1
Timeline
- 2026-01-05: disclosed: GitHub issue #768 opened
- 2026-08-27: advisory: NVD advisory published