OpenAirInterface CN5G AMF Null Dereference Vulnerability in NGAP Message Handling Allowing Denial-of-Service

A null dereference vulnerability has been identified in OpenAirInterface CN5G AMF versions through 2.0.0. The issue arises in the application's handling of unsupported NGAP protocol messages. When an unsupported procedure code and presence field tuple is received, the application incorrectly indexes into a null function pointer, leading to a dereference. This vulnerability allows an attacker with network-adjacent access to the AMF to cause a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by crashing the Access and Mobility Management Function (AMF) component of the cellular network.

Reproduction

To reproduce this vulnerability, send a crafted NGAP message to the AMF that includes an unsupported procedure code and presence field. The message should be transmitted over the N2 interface, which is accessible to remote attackers.