OMEC Project AMF Memory Corruption Vulnerability in NGSetupRequest Handler

A memory corruption vulnerability has been identified in the OMEC Project AMF component, affecting versions through 2.1.1. The issue arises in the NGSetupRequest Handler, where improper handling of registration requests with invalid formats can lead to memory corruption. This vulnerability can be exploited remotely, causing the application to crash.

Impact

Exploitation of this vulnerability leads to a crash of the AMF application, causing a denial of service.

Reproduction

The vulnerability can be reproduced by sending an NGSetupRequest followed by a RegistrationRequest (InitialUEMessage) containing an invalid SUCI format. This sequence of packets will trigger the memory corruption issue, causing the application to crash.

Remediation

Users are advised to update to the latest version of OMEC Project AMF, as this vulnerability has been addressed in version 2.1.2.