Executive brief
The Access and Mobility Management Function (AMF) component of the Omec Project, which is used in 5G core networks to manage mobile device connectivity, is vulnerable to a remote crash. An attacker can send a specially crafted network message that causes the service to shut down unexpectedly. This results in a denial-of-service condition, potentially disrupting mobile network operations and connectivity for users.
Technical details
A null pointer dereference vulnerability exists in the omec-project/amf Go package within the `HandleRanConfigurationUpdate` function in `ngap/handler.go`. The flaw is triggered when the AMF receives a malformed NGAP (Next Generation Application Protocol) message, specifically a `RANConfigurationUpdate` that lacks expected Information Elements (IEs). Because the code fails to validate the presence of these fields before access, it triggers a Go runtime panic (SIGSEGV). An attacker with network access to the AMF's NGAP interface can exploit this to crash the service. The issue is addressed in version 2.2.0 by implementing comprehensive nil-pointer and bounds checks across the NGAP dispatcher and handlers.
Affected products
- omec-project amf <= 2.1.3-dev
Timeline
- 2026-04-21: patched: Pull request 666 merged to address crashes
- 2026-04-23: disclosed: Issue 673 reported with reproduction steps
- 2026-05-18: advisory: GitHub Advisory and CVE published