NULL Pointer Dereference in free5gc AMF NGAP Dispatcher Causes DoS

Executive Summary

CVE-2026-30056 is a NULL pointer dereference vulnerability in the AMF NGAP Dispatcher of free5gc v4.0.1. It occurs when the dispatcher fails to enforce the correct NGAP message sequence during new RAN connection initialization. Instead of requiring the first message to be an NGSetupRequest, it creates an AmfRan context for any incoming message on a new SCTP connection. Attackers can exploit this by sending a crafted NGAP message like UEContextReleaseComplete as the first message, causing the handler to operate on an uninitialized UE context and trigger a panic.

Useful 0 Not Useful 0

Detection Guidance

Monitor AMF logs for crashes or panics during RAN connection initialization. Check for repeated restarts of the AMF process. Inspect SCTP traffic for NGAP messages sent as the first message on new connections.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a Denial of Service (DoS) by repeatedly crashing and restarting the AMF process. This disrupts service for legitimate users, potentially leading to network outages or degraded performance in 5G systems using free5gc v4.0.1.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade free5GC to a patched version. Implement strict NGAP message sequence validation in the AMF NGAP dispatcher. Block or filter malformed NGAP messages at the network perimeter.

Useful 0 Not Useful 0