| الوصف | ## Bug Decription
When AMF handles an NGAP InitialUEMessage carrying a NAS RegistrationRequest, the AMF process may crash with:
fatal error: concurrent map read and map write
The crash happens when multiple InitialUEMessage / RegistrationRequest messages are being processed on the same gNB SCTP connection, while the SCTP association is closed at nearly the same time. One goroutine continues processing HandleRegistrationRequest(), while another goroutine handles SCTP_SHUTDOWN_EVENT and removes the RAN context. This leads to unsynchronized access to ue.RanUe[anType].
This appears to be an implementation race-condition vulnerability in AMF, causing a crash DoS.
### Credit
Jinbo Xu, Fenghua Li, Zifu Li (State Key Laboratory of Cyberspace Security Defense; School of Cyber Security, University of Chinese Academy of Sciences; Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China)
## To Reproduce
Steps to reproduce the behavior:
1. Deploy free5GC v4.2.3 with the default configuration.
2. Use UERANSIM or a replay/fuzz harness to establish one gNB SCTP connection to AMF.
3. Send multiple NGAP InitialUEMessage messages on that association.
4. Each InitialUEMessage carries a NAS RegistrationRequest for Initial Registration with different RAN-UE-NGAP-ID values.
5. While AMF is still processing these requests, close the SCTP connection or trigger SCTP_SHUTDOWN_EVENT.
6. Observe that AMF crashes with fatal error: concurrent map read and map write.
## Expected Behavior
AMF should not crash when the gNB disconnects during registration handling.
Access to UE/RAN context should be synchronized, and the registration procedure should be aborted or rejected gracefully.
## Environment
- free5GC Version: v4.2.3
- OS: Ubuntu 22.04 LTS
- Kernel version: 6.8.0-71-generic
- go version: 1.21.8
- UERANSIM Version: v3.2.6
## Trace Files
### Configuration Files
Default free5gc configuration.
### Log File
2026-07-23T21:16:32.289990676Z [INFO][AMF][Gmm][amf_ue_ngap_id:RU:15,AU:15(3GPP)][supi:SUPI:] Handle Registration Request
2026-07-23T21:16:32.290010321Z [INFO][AMF][Gmm][amf_ue_ngap_id:RU:15,AU:15(3GPP)][supi:SUPI:] RegistrationType: Initial Registration
2026-07-23T21:16:32.290029503Z [INFO][AMF][CTX] New AmfUe [supi:][guti:20893cafe0000000018]
2026-07-23T21:16:32.289923980Z [INFO][AMF][Ngap][ran_addr:127.0.0.1:49195] SCTP_SHUTDOWN_EVENT notification, close the connection
2026-07-23T21:16:32.290076164Z [INFO][AMF][Ngap][ran_addr:127.0.0.1:49195] Remove RAN Context[ID: <PlmnID: {Mcc:208 Mnc:93}, GNbID: 00000001>]
2026-07-23T21:16:32.290113640Z [INFO][AMF][Gmm] Handle event[Gmm Message], transition from [Deregistered] to [Deregistered]
2026-07-23T21:16:32.290142837Z [INFO][AMF][Gmm][amf_ue_ngap_id:RU:,AU:(3GPP)][supi:SUPI:] Handle Registration Request
2026-07-23T21:16:32.290169480Z [ERRO][AMF][Gmm] RanUe is nil
2026-07-23T21:16:32.290038328Z [INFO][AMF][Gmm][amf_ue_ngap_id:RU:15,AU:15(3GPP)][supi:SUPI:] MobileIdentity5GS: SUCI[suci-0-208-93-0000-0-0-0000000006]
fatal error: concurrent map read and map write
goroutine 76 [running]:
internal/runtime/maps.fatal({0x116d124?, 0x5fb888?})
/root/go/pkg/mod/golang.org/[email protected]/src/runtime/panic.go:1181 +0x18
github.com/free5gc/amf/internal/gmm.HandleRegistrationRequest(0x1f1923094c08, {0x114de8c, 0xb}, 0x4119c9?, 0x1f1921f911e0)
/corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handler.go:540 +0x1746
github.com/free5gc/amf/internal/gmm.DeRegistered(0x1f1922cadd40, {0x114e653?, 0x114f1cc?}, 0x1f1921876e70)
/corefuzzer_deps/free5gc/NFs/amf/internal/gmm/sm.go:36 +0x697
github.com/free5gc/util/fsm.(*FSM).SendEvent(0x1f192177a550, 0x1f1922cadd40, {0x114e653, 0xb}, 0x1f1921876e70, 0x1f19216f6310)
/root/go/pkg/mod/github.com/free5gc/[email protected]/fsm/fsm.go:124 +0x2b5
github.com/free5gc/amf/internal/nas.Dispatch(0x1f1923094c08, {0x114de8c, 0xb}, 0xf, 0x1f1921a80aa0)
/corefuzzer_deps/free5gc/NFs/amf/internal/nas/dispatch.go:28 +0x2a8
github.com/free5gc/amf/internal/nas.HandleNAS(0x1f1921653a20, 0xf, {0x1f1922607220, 0x19, 0x20}, 0x1?)
/corefuzzer_deps/free5gc/NFs/amf/internal/nas/handler.go:71 +0x5e9
github.com/free5gc/amf/internal/ngap.handleInitialUEMessageMain(0x1f1921574750, 0x1f1921a808c0, 0x1f1921909cc0, 0x1f19213889d8, 0x1f1922cad890, 0x1f1921909d60, 0x0, 0x1f1921909dc0)
/corefuzzer_deps/free5gc/NFs/amf/internal/ngap/handler.go:580 +0xeda
github.com/free5gc/amf/internal/ngap.handlerInitialUEMessage(0x1f1921574750, 0x1f1921a808c0, 0x1f1921673a40)
/corefuzzer_deps/free5gc/NFs/amf/internal/ngap/handler_generated.go:4520 +0x21b1
github.com/free5gc/amf/internal/ngap.dispatchMain(0x1f1921574750, 0x11d3310?)
/corefuzzer_deps/free5gc/NFs/amf/internal/ngap/dispatcher_generated.go:50 +0x29f
github.com/free5gc/amf/internal/ngap.Dispatch({0x11d3310, 0x1f1921540990}, {0x1f1922af6000, 0x4c, 0x40000})
/corefuzzer_deps/free5gc/NFs/amf/internal/ngap/dispatcher.go:55 +0x3e9
github.com/free5gc/amf/internal/ngap.(*Worker).run(0x1f19214f8240)
/corefuzzer_deps/free5gc/NFs/amf/internal/ngap/scheduler.go:59 +0x21f
created by github.com/free5gc/amf/internal/ngap.NewWorker in goroutine 1
/corefuzzer_deps/free5gc/NFs/amf/internal/ngap/scheduler.go:40 +0x139 |
|---|