OpenAirInterface CN5G AMF NULL Pointer Dereference Vulnerability in NGAP Message Handling

A NULL pointer dereference vulnerability has been identified in the OpenAirInterface CN5G Access and Mobility Management Function (AMF) versions through 2.0.0. The issue arises in the ngap_app::handle_receive function, where the application fails to properly handle unsupported NGAP protocol messages. This flaw allows attackers to send crafted NGAP messages that cause a denial-of-service condition by crashing the AMF.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the AMF to crash and disrupt cellular communications managed by the AMF.

Reproduction

To reproduce this vulnerability, send a crafted NGAP message that includes an unsupported procedure code or presence field. The AMF will crash, causing a denial-of-service condition on the network.