Skip to content

Malformed UERadioCapabilityCheckResponse crashes the AMF #675

Description

@shovon0203

A malformed UERadioCapabilityCheckResponse crashes AMF. Nil Pointer Deference

AMF Version: v2.0.2

Reproduction Step:

Send this following UERadioCapabilityCheckResponse NGAP message
20 2B 00 1B 80 00 01 00 00 40 05 80 EC 1C C5 56 00 0A 00 06 80 14 EB AA 59 6E 00 1E 20 01 00

AMF Log:

2026-02-10T00:54:46.247Z	ERROR	ngap/dispatcher.go:144	NGAP decode error: per data out of range 	{"component": "AMF", "category": "NGAP", "ran_addr": "127.0.0.1:46591"}
2026-02-10T00:54:54.243Z	INFO	ngap/handler.go:1289	handle UE Radio Capability Check Response	{"component": "AMF", "category": "NGAP", "ran_addr": "127.0.0.1:46591"}
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x136eea7]
goroutine 807 gp=0xc000861180 m=8 mp=0xc000600008 [running]:
panic({0x1624140?, 0x26d9d20?})
	/usr/local/go/src/runtime/panic.go:802 +0x168 fp=0xc00002baa8 sp=0xc00002b9f8 pc=0x481128
runtime.panicmem(...)
	/usr/local/go/src/runtime/panic.go:262
runtime.sigpanic()
	/usr/local/go/src/runtime/signal_unix.go:925 +0x359 fp=0xc00002bb08 sp=0xc00002baa8 pc=0x483ab9
github.com/omec-project/amf/ngap.HandleUERadioCapabilityCheckResponse(0xc0004b7400, 0x0?)
	/go/src/amf/ngap/handler.go:1321 +0x5c7 fp=0xc00002bca0 sp=0xc00002bb08 pc=0x136eea7
github.com/omec-project/amf/ngap.DispatchNgapMsg({0x1b369a0, 0x2734720}, 0xc0004b7400, 0xc00102a2e0, 0x0)
	/go/src/amf/ngap/dispatcher.go:300 +0x105f fp=0xc00002bfa8 sp=0xc00002bca0 pc=0x136467f
github.com/omec-project/amf/ngap.Dispatch.gowrap1()
	/go/src/amf/ngap/dispatcher.go:169 +0x2e fp=0xc00002bfe0 sp=0xc00002bfa8 pc=0x136356e
runtime.goexit({})
	/usr/local/go/src/runtime/asm_amd64.s:1693 +0x1 fp=0xc00002bfe8 sp=0xc00002bfe0 pc=0x489ca1
created by github.com/omec-project/amf/ngap.Dispatch in goroutine 700
	/go/src/amf/ngap/dispatcher.go:169 +0x5c6

Advisory:
This bug has been fixed in the latest release
https://hub.docker.com/layers/omecproject/5gc-amf/rel-2.2.1/images/sha256-8a4c33cdda866094f1989bdeff6d8642fce8de8435f89defd66831c97715f5aa

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions