| Title | Open5GS Open5GS AMF <2.8.0 CWE-416: Use After Free |
|---|
| Description | ## Summary
Open5GS 2.8.0 AMF produces a heap-use-after-free in amf_nnrf_handle_failed_amf_discovery exists heap-use-after free(). AddressSanitizer detects this problem at ../src/amf/nnrf-handler.c:304 when SIGTERM terminates the AMF.
## Details
The amf_nnrf_handle_failed_amf_discovery(ogs_sbi_xact_t *sbi_xact) function frees the sbi_xact using ogs_sbi_xact_remove(sbi_xact), and after that, the amf_nnrf_try_old_amf_discovery_fallback(amf_ue, requester_nf_type, discovery_option) function uses discovery_option as its parameter, and the discovery_option = sbi_xact->discovery_option, which has been freed before its usage.
```C
discovery_option = sbi_xact->discovery_option;
if (sbi_xact->user_data) {
amf_sbi_xact_ctx_t *ctx = sbi_xact->user_data;
if (ctx->ran_ue_id != OGS_INVALID_POOL_ID)
ran_ue_id = ctx->ran_ue_id;
}
ogs_assert(sbi_object->type > OGS_SBI_OBJ_BASE &&
sbi_object->type < OGS_SBI_OBJ_TOP);
ogs_sbi_xact_remove(sbi_xact); //discovery_option is freed
switch(sbi_object->type) {
case OGS_SBI_OBJ_UE_TYPE:
amf_ue = amf_ue_find_by_id(sbi_object_id);
if (!amf_ue) {
ogs_error("UE(amf_ue) Context has already been removed");
break;
}
ogs_error("[%s:%s] Cannot receive SBI message "
"[type:%d,value:%d]", amf_ue->supi, amf_ue->suci,
amf_ue->nas.message_type,
amf_ue->nas.registration.value);
if (amf_nnrf_try_old_amf_discovery_fallback(
amf_ue, requester_nf_type, discovery_option)) //discovery_option is used after free
break;
```
## Proof of Concept:
I'm using a AFLNET with SCTP support to test the open5gs AMF, and I collect NGAP traffic to generate mutated input and using AddressSanitizer to detect memory error.
The AMF output is as bellow:
```Log
==119214==ERROR: AddressSanitizer: heap-use-after-free on address 0x518000010327 at pc 0x632bcadd0527 bp 0x7329e280c960 sp 0x7329e280c950
READ of size 1 at 0x518000010327 thread T1
#0 0x632bcadd0526 in amf_nnrf_try_old_amf_discovery_fallback ../src/amf/nnrf-handler.c:45
#1 0x632bcadd0c5e in amf_nnrf_handle_failed_amf_discovery ../src/amf/nnrf-handler.c:304
#2 0x632bcad83901 in amf_state_operational ../src/amf/amf-sm.c:470
#3 0x732a4d7bf622 in ogs_fsm_dispatch ../lib/core/ogs-fsm.c:127
#4 0x632bcacde6f2 in amf_main ../src/amf/init.c:163
#5 0x732a4d78911b in thread_worker ../lib/core/ogs-thread.c:67
#6 0x732a4a094ac2 in start_thread nptl/pthread_create.c:442
#7 0x732a4a1268cf (/lib/x86_64-linux-gnu/libc.so.6+0x1268cf)
0x518000010327 is located 679 bytes inside of 784-byte region [0x518000010080,0x518000010390)
freed by thread T1 here:
#0 0x732a4d8b4537 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
#1 0x732a4d7432a3 (/lib/x86_64-linux-gnu/libtalloc.so.2+0x42a3)
previously allocated by thread T1 here:
#0 0x732a4d8b4887 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x732a4d743d7f (/lib/x86_64-linux-gnu/libtalloc.so.2+0x4d7f)
Thread T1 created by T0 here:
#0 0x732a4d858685 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:216
#1 0x732a4d789476 in ogs_thread_create ../lib/core/ogs-thread.c:96
#2 0x632bcacdecc4 in amf_initialize ../src/amf/init.c:74
#3 0x632bcacdd451 in app_initialize ../src/amf/app.c:28
#4 0x632bcacdbf3a in main ../src/main.c:219
#5 0x732a4a029d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
SUMMARY: AddressSanitizer: heap-use-after-free ../src/amf/nnrf-handler.c:45 in amf_nnrf_try_old_amf_discovery_fallback
Shadow bytes around the buggy address:
0x0a307fffa010: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0a307fffa020: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0a307fffa030: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0a307fffa040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0a307fffa050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0a307fffa060: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
0x0a307fffa070: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0a307fffa080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0a307fffa090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0a307fffa0a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0a307fffa0b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==119214==ABORTING
```
## Fix
This vulability has been addressed in open5gs issue and fixed by maintainer in commit c4a7d70. |
|---|
| Source | ⚠️ https://github.com/open5gs/open5gs/pull/4698 |
|---|
| User | centauruszzz (UID 100408) |
|---|
| Submission | 08/07/2026 04:49 (1 month ago) |
|---|
| Moderation | 09/13/2026 10:02 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 403249 [Open5GS up to 2.7.x Old AMF Discovery Fallback src/amf/nnrf-handler.c amf_nnrf_try_old_amf_discovery_fallback discovery_option use after free] |
|---|
| Points | 20 |
|---|