OMEC Project AMF Memory Corruption Vulnerability in PDUSessionResourceModifyIndication Function

A memory corruption vulnerability has been identified in the OMEC Project AMF control plane function for 5G core networks, affecting versions through 2.1.1. The issue arises in the PDUSessionResourceModifyIndication function within the NGAP handler file. This vulnerability allows for remote exploitation, leading to a crash of the AMF component.

Impact

Exploitation of this vulnerability causes a segmentation fault, crashing the AMF process. The error log indicates a nil pointer dereference, which is a common cause of such crashes in Go applications.

Reproduction

The vulnerability can be reproduced by sending a PDUSessionResourceModifyIndication message over NGAP before the necessary NG Context has been established. This can be done using a network simulation tool or script that sends NGAP messages to the AMF component.

Remediation

Users are advised to update to the latest version of OMEC Project AMF, where this vulnerability has been addressed.