Denial of Service in OMEC Project AMF

Mitigation Strategies

The immediate step to mitigate this vulnerability is to apply the patch identified by commit 34bc6724acc97dba1f8691e586da95b042cb612d, which fixes the issue by adding input validation and error handling to prevent crashes caused by malformed NGAP messages.

If patching is not immediately possible, consider implementing network-level filtering to block malformed NGAP messages, especially those targeting the RRCInactiveTransitionReport function.

Monitor the AMF service for crashes and restart it promptly if a crash occurs to maintain availability.

• Update the omec-project amf to version 2.2.1 or later where the fix is included.
• Implement input validation and error handling improvements as described in the patch if custom builds are used.
• Use telemetry and monitoring tools to detect abnormal behavior or crashes in the AMF.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the omec-project AMF (Access and Mobility Management Function) component, specifically affecting the function RRCInactiveTransitionReport within the NGAP Message Handler. A malformed RRCInactiveTransitionReport message can cause the AMF to crash due to a nil pointer dereference error, resulting in a denial of service. The attack can be performed remotely by sending a specially crafted NGAP message. The issue has been publicly disclosed and a patch has been released to fix it by improving input validation and error handling.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can lead to a denial of service condition in the AMF component of a 5G core network. This means that the AMF may crash or become unavailable when processing malformed NGAP messages, disrupting critical network functions such as registration, connection management, and mobility management. Since the AMF is a key control plane function, its unavailability can impact the overall availability and reliability of the 5G network services.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for crashes or segmentation faults (SIGSEGV) in the AMF component, specifically related to the handling of malformed NGAP messages such as RRCInactiveTransitionReport.

Detection involves observing logs for Go runtime crashes or segmentation faults triggered by malformed NGAP messages.

A practical approach is to send a malformed RRCInactiveTransitionReport NGAP message to the AMF and observe if it crashes, which indicates the vulnerability is present.

• Use network packet crafting tools (e.g., scapy or similar) to send malformed NGAP messages targeting the RRCInactiveTransitionReport function.
• Monitor AMF logs for segmentation faults or panic messages related to nil pointer dereferences.
• Check system logs or container logs for crash reports or restarts of the AMF service.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not explicitly mention the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0