Executive brief
The omec-project Access and Mobility Management Function (AMF), a core component of 5G mobile networks, is vulnerable to a memory corruption issue. An attacker can send specially crafted network registration requests to crash the service, potentially leading to a denial of service for mobile subscribers. This impact could disrupt connectivity and network operations for affected users.
Technical details
A memory corruption vulnerability exists in the omec-project AMF (Access and Mobility Management Function) within the NGSetupRequest Handler and NAS conversion components. The flaw is triggered by improper restriction of operations within the bounds of a memory buffer (CWE-119) when handling a RegistrationRequest with an invalid SUCI (Subscription Concealed Identifier) format. Specifically, the `nasConvert.SuciToString` function can encounter an out-of-bounds index error (e.g., index -1) when attempting to convert malformed MobileIdentity data. A remote attacker with low privileges can exploit this by sending a crafted InitialUEMessage, leading to a service panic and crash. The issue is addressed in version 1.7.1-0.20260421213846-34bc6724acc9 and later.
Affected products
- omec-project amf < 1.7.1-0.20260421213846-34bc6724acc9
Timeline
- 2026-04-21: patched: Fix merged in pull request 666
- 2026-04-23: disclosed: Public issue report on GitHub
- 2026-05-23: advisory: NVD publication date
- 2026-05-26: advisory: GitHub Advisory published