OpenAirInterface Security Mode Integrity Bypass Vulnerability in 5G Registration

A vulnerability in OpenAirInterface version 2.2.0 allows the acceptance of Security Mode Complete messages without proper integrity protection. The software supports integrity algorithms NIA1 and NIA2, but when a User Equipment (UE) initiates registration with only the IA0 security capability, OpenAirInterface improperly accepts and processes the request. This creates a downgraded security context that could be exploited for replay attacks.

Impact

Exploitation of this vulnerability could lead to unauthorized replay of messages in the 5G communication process, potentially causing disruptions or unauthorized actions.

Reproduction

The vulnerability can be reproduced by sending an initial registration request from a UE that only supports the IA0 security capability. OpenAirInterface will accept this request, bypassing the integrity checks that should be enforced.