Executive brief
The omec-project Access and Mobility Management Function (AMF), a core component of 5G mobile networks, is vulnerable to a remote crash. An attacker can send a specially crafted location report message that causes the service to fail due to a memory error. This results in a denial-of-service condition, potentially disrupting mobile connectivity for users managed by the affected network node.
Technical details
A vulnerability in the NGAP Message Handler of omec-project amf (up to version 2.1.1) allows for a remote denial-of-service. The flaw is rooted in a nil pointer dereference within the `HandleLocationReport` function in `ngap/handler.go`. An attacker with network access can trigger a panic by sending a malformed NGAP LocationReport message containing unexpected or missing protocol Information Elements (IEs). This leads to memory corruption/segmentation violation, crashing the AMF process. The issue has been addressed in version 2.2.0 and later by implementing comprehensive nil checks and input validation across the NGAP dispatcher and handlers.
Affected products
- omec-project amf <= 2.1.1
Timeline
- 2026-04-21: patched: Pull request 666 merged to address crashes
- 2026-04-23: disclosed: Issue 672 opened with reproduction steps
- 2026-05-12: advisory