A critical integrity validation flaw in Linux Foundation Magma 1.9.0 permits remote attackers to bypass security protections, potentially facilitating replay attacks.

This vulnerability involves improper validation of integrity check values within the SecurityModeComplete handler. An unauthenticated remote attacker can craft NAS packets that declare integrity capability as IA0 only, causing the Access and Mobility Management Function (AMF) to incorrectly accept the connection without proper integrity verification.

The exploitation of this flaw allows attackers to circumvent 3GPP-mandated integrity protections, which are vital for maintaining secure communication between User Equipment and the core network. Given the CVSS score of 8.3, this represents a high-risk scenario where an attacker could perform replay attacks, potentially leading to unauthorized command execution or interception of network traffic, resulting in significant service disruption and loss of subscriber privacy.

Immediate Action: There is currently no official patch available for this vulnerability. Administrators should restrict access to the Magma Access Gateway and monitor network traffic for anomalous registration patterns or NAS packets declaring IA0 integrity capabilities.

Proactive Monitoring: Security teams should review system logs for recurring or failed SecurityModeComplete handler events. Additionally, monitor for unexpected UE capability declarations that deviate from established 5G security policies.

Compensating Controls: Implement strict network perimeter controls and utilize firewalls to filter traffic to the Magma Core, ensuring that only trusted or expected traffic reaches the AMF subcomponent.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the official Magma GitHub issue tracker.

Given the high CVSS score and the existence of a public proof-of-concept, organizations running Linux Foundation Magma 1.9.0 must prioritize this issue. Since a formal patch is currently missing, immediate defensive posture should focus on network segmentation and deep packet inspection to identify and block malformed NAS registration requests until the vendor provides a formal security update.