OMEC Project AMF Memory Corruption Vulnerability in NGAP Message Handler

A memory corruption vulnerability has been identified in the OMEC Project AMF component, specifically in versions through 2.1.1. The issue arises within the NGAP Message Handler, where improper handling of certain messages can lead to memory corruption. This vulnerability can be exploited remotely, causing the AMF process to crash. The problem has been acknowledged and fixed in the latest release, version 2.2.1.

Impact

Exploitation of this vulnerability causes a segmentation fault, leading to a crash of the AMF process.

Reproduction

The vulnerability can be reproduced by sending a malformed NGAP LocationReport message to the AMF instance. This message should include specific byte sequences that trigger the nil pointer dereference, causing the application to crash.

Remediation

Users are advised to update to OMEC Project AMF version 2.2.1, where this vulnerability has been fixed.