Executive brief
The omec-project Access and Mobility Management Function (AMF), a core component of 5G mobile networks, is vulnerable to a remote crash. By sending specially crafted network messages, an attacker can trigger a system failure (panic), leading to a denial of service for mobile subscribers. This could disrupt connectivity and network operations until the service is restarted.
Technical details
A vulnerability in the NGReset Message Handler of omec-project amf (up to version 2.1.1) allows for memory corruption and service crashes. The root cause is a nil pointer dereference in the `printAndGetCause` and `HandleNGReset` functions within `ngap/handler.go` when processing malformed NGAP packets. A remote attacker with network access can trigger a Go runtime panic by sending a crafted NGReset message with missing or invalid Information Elements (IEs). This issue was addressed in version 1.7.1-0.20260421213846-34bc6724acc9 (and later 2.2.0) by implementing proper nil checks and input validation across the NGAP dispatcher and handlers.
Affected products
- omec-project amf < 1.7.1-0.20260421213846-34bc6724acc9
Timeline
- 2026-04-21: patched: Fix merged in pull request 666
- 2026-04-23: disclosed: Issue 678 reported with reproduction steps
- 2026-05-23: advisory: NVD publication date
- 2026-05-26: advisory: GitHub Advisory published