Description

A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted NGAP messages during the initialization of a new RAN connection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T17:17:50.783Z",
  "pubdate": "2026-08-27T17:17:50.783Z",
  "executiveSummary": "A critical NULL pointer dereference vulnerability exists within the AMF (Access and Mobility Management Function) NGAP (Next Generation Application Protocol) Dispatcher component of free5gc version 4.0.1.\nThe vulnerability manifests during the initialization phase of a Radio Access Network (RAN) connection.\nBy transmitting malformed or specifically crafted NGAP messages to the AMF, a remote attacker can trigger an unhandled NULL pointer dereference, leading to an immediate process crash and subsequent Denial of Service (DoS) of the AMF service.\nBecause the AMF is a central control plane component in the 5G core network, this vulnerability poses a severe threat to network availability, effectively disrupting all UEs (User Equipment) managed by the affected instance.\nExploitation does not require prior authentication, as the vulnerability is reachable during the initial connection setup procedure. The primary risk implication is the potential for large-scale network service outages if the AMF instance fails to recover or enters an unstable state upon the crash.",
  "technicalDetails": "The vulnerability resides within the AMF NGAP Dispatcher, which is responsible for parsing and routing incoming NGAP protocol data units (PDUs) received from gNodeBs (gNBs). The root cause is a failure to adequately validate the presence of mandatory information elements (IEs) or internal data pointers before accessing them during the RAN connection initialization sequence.\nWhen a gNB initiates a connection, the AMF dispatcher processes the initial NGAP messages. If an attacker injects a maliciously crafted NGAP message that omits expected fields or triggers an unexpected conditional branch within the parser, the internal state machine may attempt to dereference a NULL pointer associated with the expected, yet absent, object.\nThe attack flow proceeds as follows: First, the attacker establishes a connection to the AMF via the N2 interface. Second, the attacker sends a malformed NGAP message, such as an InitialUEMessage or a SetupRequest, containing an intentionally incomplete structure. Third, the dispatcher component fails to perform a null-check on the resulting pointer, leading to a segmentation fault when the application attempts to access the member functions or attributes of the dereferenced object.\nThis behavior occurs within the context of the free5gc core network architecture where the AMF acts as the primary signaling termination point. Because this happens at the dispatcher level, it affects the entire control plane functionality for the affected NGAP stack. No privileges are required by the attacker, as the N2 interface is designed to accept initial connection requests from gNBs without pre-existing sessions.\nThe post-exploitation impact is a definitive service crash. In many containerized deployments, this will force a service restart; however, constant re-triggering of this vulnerability can result in a state of persistent denial of service. The vulnerability highlights a weakness in the defensive programming of the NGAP protocol parser, specifically regarding the handling of negative or unexpected protocol inputs during the state transition from 'Disconnected' to 'Connected'."
}